VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 2, 2020· Updated Aug 5, 2024

CVE-2018-18623

CVE-2018-18623

Description

Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Grafana 5.3.1 has a stored XSS vulnerability in the Text Panel due to incomplete sanitization, enabling arbitrary JavaScript execution.

Vulnerability

Overview CVE-2018-18623 is a cross-site scripting (XSS) vulnerability in Grafana versions prior to 6.0.0, specifically affecting the "Text Panel" feature within dashboards. The issue stems from an incomplete fix for the earlier CVE-2018-12099, where the application fails to properly sanitize user-supplied HTML input in text panels [1][4]. This allows attackers to inject and execute arbitrary JavaScript code in the context of a victim's browser session.

Exploitation

Conditions To exploit this vulnerability, an attacker must have access to create or edit a Grafana dashboard, typically requiring authenticated access with at least Editor privileges. However, if a dashboard is publicly shared or the attacker tricks a privileged user into rendering a malicious text panel, the XSS could be triggered without direct authentication [1]. The attack surface is the Dashboard > Text Panel screen, where unsanitized HTML is rendered.

Impact

Successful exploitation enables the attacker to perform actions on behalf of the victim, including session hijacking, unauthorized dashboard modifications, data exfiltration, or redirecting the user to malicious sites. Since Grafana often handles sensitive metrics and alerts, the impact can extend to privilege escalation within the Grafana instance [4].

Mitigation

The vulnerability is fixed in Grafana v6.0.0 and later releases [2]. Users running Grafana 5.3.1 or earlier versions should upgrade immediately. As a workaround, administrators can disable HTML rendering in text panels or restrict dashboard editing privileges to trusted users only [1].

References
  1. XSS sanitize text panels by jschill · Pull Request #14984 · grafana/grafana
  2. Release v6.0.0 · grafana/grafana
  3. XSS: Option to disable and / or sanitize html in text panels

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 6.0.0-beta16.0.0-beta1

Affected products

242

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.