Bug 2358582 (CVE-2025-2703)

Summary: CVE-2025-2703 grafana: Cross-Site Scripting in Grafana XY Chart Panel
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: lchilton, security-response-team, sfeifer
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A DOM-based Cross-site scripting vulnerability exists in Grafana's built-in XY Chart plugin. This flaw allows an attacker with editor-level privileges to inject and execute arbitrary JavaScript code by editing an XY Chart Panel. The vulnerability bypasses the Content Security Policy, allowing the script to execute when the chart is rendered.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-04-09 08:56:13 UTC 
A flaw exist in Grafana where the built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions can edit an XY Chart Panel to include an XSS payload, which will execute arbitrary JavaScript upon render. Due to the nature of the XSS, the current Content Security Policy is NOT effective at stopping the JavaScript from executing.