go package report

Is grafana:grafana safe?

3 known vulnerabilities, worst severity HIGH.

cvss
7.3
high

severity out of 10

epss
0.25%
low

chance of exploitation in 30 days, 17th percentile of all CVEs

xyz score
3.3
low

CyberXYZ composite out of 10

fig. 01 — CVE-2026-9029, the advisory selected below

// 3 advisories

CVE-2026-9029

HIGH

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected
>=2.0.0-beta1
Fixed in
not stated
Weakness
CWE-79, Cross-site scripting
Published
2026-06-22, updated 2026-09-21
Sources
NVD
// references
// dependencies

0 direct

Create a free accountfor dependency paths and remediation
// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.

Checked 2026-09-22 at 17:31 UTC. The most recent advisory here was published 2026-06-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is grafana:grafana safe? go package security report | CyberXYZ