CVE-2025-2703

A DOM-based Cross-site scripting vulnerability exists in Grafana's built-in XY Chart plugin. This flaw allows an attacker with editor-level privileges to inject and execute arbitrary JavaScript code by editing an XY Chart Panel. The vulnerability bypasses the Content Security Policy, allowing the script to execute when the chart is rendered.

This vulnerability is classified as a Moderate severity due to the ability of authenticated users with Editor permissions to inject arbitrary JavaScript into XY Chart panels. When the panel is rendered, the payload executes in the user's browser context, bypassing existing Content Security Policy (CSP) protections. This allows for potential session hijacking or data exfiltration. While the exploit requires some user privileges and interaction, the security boundary between trusted editors and secure rendering is violated.

It is important to note that this issue affects Grafana versions 11.1.0 and later, which are not included in any Red Hat supported builds. Therefore, Red Hat customers are not impacted by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.