-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 8.5.22 | 8.5.22 |
| github.com/grafana/grafana | go | >= 9.0.0, < 9.2.15 | 9.2.15 |
| github.com/grafana/grafana | go | >= 9.3.0, < 9.3.11 | 9.3.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the FunctionDescription component in Graphite datasource handling. The advisory explicitly shows the component uses dangerouslySetInnerHTML with raw rst2html output, which doesn't perform HTML sanitization. This allows XSS payloads in Graphite function descriptions to execute when rendered. The file path and component structure match the technical details provided in the security advisory's mitigation section.