How severe is CVE-2022-31097?

CVE-2022-31097 has a CVSS score of 7.3/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2022-31097?

CVE-2022-31097 affects the following packages: github.com/grafana/grafana (Go), github.com/grafana/grafana (Go), github.com/grafana/grafana (Go), github.com/grafana/grafana (Go). Ecosystems affected: Go.

How do I fix CVE-2022-31097?

Update github.com/grafana/grafana to 9.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-31097 is resolved across your whole dependency graph.

How do I detect CVE-2022-31097 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-31097 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is CVE-2022-31097 actively exploited in the wild?

No public exploit code has been indexed for CVE-2022-31097 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2022-31097?

CVE-2022-31097 has an EPSS (Exploit Prediction Scoring System) score of 70.1%, placing it in the 99th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. A score above 50% indicates significantly elevated exploitation risk — immediate patching is strongly recommended.

What type of vulnerability is CVE-2022-31097?

CVE-2022-31097 is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2022-31097 published, and has it been updated?

CVE-2022-31097 was published on July 15, 2022 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

HIGH severity

CVE-2022-31097 — grafana

HIGH

CVE-2022-31097 is a high-severity (CVSS 7.3) Cross-site Scripting (XSS) vulnerability in github.com/grafana/grafana. EPSS puts its 30-day exploitation probability at 70.1% (99th percentile). A fix is available for github.com/grafana/grafana — see the affected versions and patch details below.

Stored XSS in Grafana's Unified Alerting

Also known asBIT-grafana-2022-31097GHSA-vw7q-p2qg-4m5fGO-2024-2857

Published

Jul 15, 2022

Updated

Oct 28, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

A successful exploit gives an attacker total control of the affected component, not partial access.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-31097.

EPSS Exploitation Probability

via FIRST.org ↗

70.1%probability of exploitation in next 30 days

Very High Risk0.00%

Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected

🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for a stored Cross Site Scripting in Grafana.

Release v.9.0.3, containing this security fix and other patches:

Release v.8.5.9, containing this security fix and other fixes:

Release v.8.4.10, containing this security fix and other fixes:

Release v.8.3.10, containing this security fix and other fixes:

Download Grafana 8.3.10

Stored XSS (CVE-2022-31097)

Summary

On June 19 a security researcher contacted Grafana Labs to disclose a XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to elevate privileges from Editor to Admin.

We believe that this vulnerability is rated at CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).

Impact

An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link.

Affected versions with HIGH severity

All Grafana >=8.0 versions are affected by this vulnerability.

Solutions and mitigations

All installations after Grafana v8.0 should be upgraded as soon as possible.

As a workaround it is possible to disable alerting or use legacy alerting.

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

Timeline

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2022-06-19 10:32 - Research submission of vulnerability report 2022-06-20 14:35- Issue triaged, confirmed positive, and internal incident raised 2022-06-20 18:40 - Fix PR submitted and reviewed 2022-06-23 07:12 - All Grafana Cloud hosted Grafana instances patched 2022-07-05 07:14 - Customers informed under embargo 2022-07-14 02:00 - Public release

Acknowledgement

We would like to thank Maxim Misharin for responsibly disclosing the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/grafana/grafana`	≥ 9.0.0&&< 9.0.3	9.0.3`go get github.com/grafana/grafana@v9.0.3`
🐹Go	`github.com/grafana/grafana`	≥ 8.5.0&&< 8.5.9	8.5.9`go get github.com/grafana/grafana@v8.5.9`
🐹Go	`github.com/grafana/grafana`	≥ 8.4.0&&< 8.4.10	8.4.10`go get github.com/grafana/grafana@v8.4.10`
🐹Go	`github.com/grafana/grafana`	≥ 8.0.0&&< 8.3.10	8.3.10`go get github.com/grafana/grafana@v8.3.10`

Affected Products

2 products · 5 configurations

Application

grafanagrafana

≥ 9.0.0 && < 9.0.3

range

Application

e-series performance analyzernetapp

all

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/grafana/grafana to 9.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-31097 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

Workaround published by Red Hat

Disable Unified alerting. https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#unified_alerting

Source: Red Hat security advisory for CVE-2022-31097 (CC BY 4.0)

Product	Fixed in	Advisory
Red Hat Ceph Storage 6.1	`rhceph/rhceph-6-dashboard-rhel9:6-75`	RHSA-2023:3642

Frequently Asked Questions

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for a stored Cross Site Scripting in Grafana. Release v.9.0.3, containing this security fix and other patches: - [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3) - [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/) Release v.8.5.9, containing this security fix and other fixes: - [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9) - [Release notes](https://grafana.com/docs/grafana/next/release-not

O3 Security · Impact-Aware SCA

Is CVE-2022-31097 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

7.3/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Raw vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE Classification

CWE-79Cross-site Scripting (XSS)

Weaponization

No Nuclei template, Metasploit module or public proof-of-concept found.

Timeline

Disclosed

Jul 15, 2022

Last updated

Oct 28, 2026

Identifiers

CVE-2022-31097

GHSA-vw7q-p2qg-4m5f

BIT-grafana-2022-31097

GO-2024-2857

References

Advisorygithub.com · CVE 2022 31097.json Advisorygithub.com · GHSA vw7q p2qg 4m5f Advisorynvd.nist.gov · CVE 2022 31097 Advisorysecurity.netapp.com · ntap 20220901 0010 Webgrafana.com · release notes 8 5 9 Webgrafana.com · release notes 9 0 3 Webgrafana.com · release notes 8 4 10 Webgrafana.com · release notes 8 5 9 Webgrafana.com · release notes 9 0 3 Webgrafana.com · release notes 8 4 10 Websecurity.netapp.com · ntap 20220901 0010 Packagegithub.com · grafana

Related vulnerabilities

This CVE is high severity; 3 of 8 other CVEs affecting grafana are rated as high or higher (top: high).

CVE-2026-42127CVE-2026-10601CVE-2026-9029CVE-2026-42129CVE-2026-33380CVE-2026-33381CVE-2026-21727CVE-2026-27877

Provenance

Sources

OSV.devNVDFIRST.org (EPSS)

Last verifiedOct 28, 2026

CVE-2022-31097 — grafana

Exploitation Status

No confirmed exploitation observed yet

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

Description

Stored XSS (CVE-2022-31097)

Summary

Impact

Affected versions with HIGH severity

Solutions and mitigations

Timeline

Acknowledgement

Reporting security issues

Security announcements

Affected Packages

Affected Products

Detection & mitigation playbook

Detect

Fix

Workarounds

Fixing This On Your OS

Frequently Asked Questions

Is CVE-2022-31097 in your dependencies?