The vulnerability allows a malicious user to embed JavaScript into Grafana’s Explore Traces view by inserting script tags into the stack trace field. When the trace is rendered, the embedded JavaScript is executed in the viewing browser, potentially permitting cookie theft, session hijacking, or defacement. The weakness is a classic input validation flaw catalogued as CWE‑79.

Grafana Grafana and Grafana Grafana‑Enterprise are affected. Known vulnerable releases include Grafana 12.2.4 and 12.3.2, as well as any miscellaneous builds matching the generic Grafana CPE. Only traces that originate from Jaeger HTTP API endpoints are susceptible; Jaeger gRPC and Tempo are unaffected.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis, and the issue is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to inject malicious content into a Jaeger HTTP API trace, then have a user view that trace in Grafana. If the attacker controls the Jaeger source, this can be performed remotely through the Jaeger API, though it also poses risks to internal users viewing affected traces.