UBUNTU-CVE-2025-41117

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2025-41117

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-41117.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-41117

Upstream

CVE-2025-41117

Published

2026-02-13T00:00:00Z

Modified

2026-02-13T18:30:26.853721Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

References

Affected packages

Ubuntu:16.04:LTS / grafana

Package

Name: grafana
Purl: pkg:deb/ubuntu/grafana@2.6.0+dfsg-1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.6.0+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.6.0+dfsg-1",
            "binary_name": "grafana"
        },
        {
            "binary_version": "2.6.0+dfsg-1",
            "binary_name": "grafana-data"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-41117.json"