A flaw exist in Grafana where the built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions can edit an XY Chart Panel to include an XSS payload, which will execute arbitrary JavaScript upon render. Due to the nature of the XSS, the current Content Security Policy is NOT effective at stopping the JavaScript from executing.