NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

CVE-2023-0594 — grafana

HIGH

CVE-2023-0594 is a high-severity (CVSS 7.3) Cross-site Scripting (XSS) vulnerability in github.com/grafana/grafana. A fix is available for github.com/grafana/grafana — see the affected versions and patch details below.

Grafana vulnerable to Cross-site Scripting

Also known asBIT-grafana-2023-0594GHSA-xw5p-hw8j-xg4q
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2023-0594.

EPSS Exploitation Probability

via FIRST.org ↗
9.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs95th percentile — riskier than 95% of all scored CVEsHighest risk
0.99%15.6%30.2%44.9%36.6%9.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected
🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Grafana is an open-source platform for monitoring and observability.

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript.

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/grafana/grafana≥ 7.0.0&&< 8.5.218.5.21go get github.com/grafana/grafana@v8.5.21
🐹Gogithub.com/grafana/grafana≥ 9.0.0&&< 9.2.139.2.13go get github.com/grafana/grafana@v9.2.13
🐹Gogithub.com/grafana/grafana≥ 9.3.0&&< 9.3.89.3.8go get github.com/grafana/grafana@v9.3.8

Affected Products

1 product · 3 configurations
Application
grafanagrafana
≥ 9.3.0 && < 9.3.8
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/grafana/grafana to 8.5.21 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-0594 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is an issue with Grafana Tempo which we don't ship in Red Hat Enterprise Linux. Hence, RHEL-8, 9 are not-affected.

Workaround published by Red Hat
Applying the Content-Security-Policy shipped with Grafana would block inline scripts from executing and would mitigate this.
Source: Red Hat security advisory for CVE-2023-0594 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ceph Storage 5.3rhceph/rhceph-5-dashboard-rhel8:5-83RHSA-2024:0746

Frequently Asked Questions

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a
O3 Security · Impact-Aware SCA

Is CVE-2023-0594 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2023-0594: grafana XSS — Fixed in 8.5.21