Grafana -- DOM XSS vulnerability

2025-04-24 · CVE-2025-2703 · VuXML entry

Grafana Labs reports: An external security researcher responsibly reported a security vulnerability in Grafana’s built-in XY chart plugin that is vulnerable to a DOM XSS vulnerability . The CVSS score for this vulnerability is 6.8 MEDIUM .

Affected versions

• grafana >= 11.1.0 < 11.2.8+security-01; >= 11.3.0 < 11.3.5+security-01; >= 11.4.0 < 11.4.3+security-01; >= 11.5.0 < 11.5.3+security-01; >= 11.6.0 < 11.6.0+security-01

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.