high7.3
CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable.
Impact
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | >= 2.0.0-beta1, < 12.4.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | Version 12.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9g84-39mm-q4p3
- https://nvd.nist.gov/vuln/detail/CVE-2026-9029
- https://grafana.com/security/security-advisories/cve-2026-9029
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58
- https://github.com/grafana/grafana/releases/tag/v12.4.4
- https://github.com/grafana/grafana/releases/tag/v13.0.2