Grafana Labs 11.1.0 < 11.2.8+security-01

CVE-2025-2703 is a stored DOM-based cross-site scripting flaw in Grafana's built-in XY Chart plugin. The fieldValueColors() function in scatter.ts interpolates threshold step values directly into a dynamically constructed JavaScript function without sanitization. An attacker with Editor permissions (or the fixed:library.panels:general.writer RBAC permission) can inject arbitrary JavaScript into a panel's threshold configuration. When any other user — including an Org Admin — views the poisoned dashboard, the payload fires in their browser session. Affected versions span Grafana 11.1.0 through 11.5.x (pre-patch). Fixed in 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, and 11.6.0+security-01.

Grafana rates this Medium (CVSS 6.8) and that assessment is honest. Tenable's legacy CVSS v2 score of 7.3 pushes the plugin into a 'High' label, which is misleading — the v3.1 vector correctly captures the authentication prerequisite (PR:L) and mandatory user interaction (UI:R). The real friction is the Editor role gate: this is not an unauth RCE or even a Viewer-accessible bug. An attacker who already holds Editor credentials has significant access to begin with. The XSS adds a privilege-escalation vector to Admin, but it requires a social-engineering step (the victim must open the dashboard). Sonar's detailed writeup by Paul Gerste provides a near-complete exploitation blueprint, which elevates the risk above a typical stored XSS, but the chain is still fundamentally *auth + click*.

1. Enable Trusted Types in Content Security Policy — Grafana supports a Content-Security-Policy header with require-trusted-types-for 'script'. This blocks the DOM XSS sink entirely by preventing untrusted strings from being passed to eval-like functions. This is Grafana's own recommended mitigation and should be deployed as the primary compensating control. Per noisgate mitigation SLA for MEDIUM, there is no mitigation deadline — go straight to the 365-day remediation window. However, enabling Trusted Types is low-effort and worth doing immediately.
2. Audit and restrict Editor role assignments — Review Grafana org role mappings in your SSO/LDAP integration. Ensure new users default to Viewer, not Editor. Revoke Editor from accounts that do not actively need panel-editing capability. This reduces the pool of accounts that could inject a payload.
3. Enable and monitor Grafana audit logging — Grafana Enterprise includes audit logging for dashboard changes, panel edits, and data source access. Forward these to your SIEM and alert on non-numeric threshold values in XY Chart panel JSON or unexpected dashboard sharing events to Org Admins.
4. Upgrade Grafana to a patched version — Apply the vendor patch: upgrade to 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01, or any later release. Per the noisgate remediation SLA for MEDIUM, complete within 365 days of assessment. Given this CVE is already 17 months old, prioritize in your next maintenance window.
5. Restrict outbound network from user browsers via proxy — If your Grafana users access dashboards through a corporate browser or proxy, block outbound requests to unknown domains. This disrupts the exfiltration callback required for session-token theft.

Run this script from any host with network access to your Grafana instance. It queries the Grafana API health endpoint (unauthenticated) to detect the running version and checks against the affected range. Usage: bash check_cve_2025_2703.sh https://grafana.example.com:3000. No special privileges required — the /api/health endpoint is public by default.

#!/usr/bin/env bash
# CVE-2025-2703 Checker — Grafana XY Chart DOM XSS
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -euo pipefail

GRAFANA_URL="${1:-http://localhost:3000}"
GRAFANA_URL="${GRAFANA_URL%/}"

# Attempt version detection via health endpoint
VERSION=$(curl -sf --max-time 10 "${GRAFANA_URL}/api/health" 2>/dev/null \
  | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  VERSION=$(curl -sf --max-time 10 "${GRAFANA_URL}/api/frontend/settings" 2>/dev/null \
    | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine Grafana version from ${GRAFANA_URL}"
  exit 2
fi

echo "Detected Grafana version: ${VERSION}"

# Track security suffix
HAS_SEC=0
[[ "$VERSION" == *"+security"* ]] && HAS_SEC=1
BASE="${VERSION%%+*}"

# semver compare: returns 0 if $1 >= $2
ver_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Below affected range
if ! ver_gte "$BASE" "11.1.0"; then
  echo "PATCHED - Version ${VERSION} is below the affected range (< 11.1.0)"
  exit 0
fi

# Above all affected branches (11.6.1+ is safe regardless)
if ver_gte "$BASE" "11.6.1"; then
  echo "PATCHED - Version ${VERSION} is above all affected branches"
  exit 0
fi

# Check each fixed branch
check_branch() {
  local fix="$1" ceil="$2"
  if ver_gte "$BASE" "$fix" && ! ver_gte "$BASE" "$ceil"; then
    if [ "$HAS_SEC" -eq 1 ]; then
      echo "PATCHED - Version ${VERSION} includes the security fix"
      exit 0
    fi
  fi
}

check_branch "11.6.0" "11.6.1"
check_branch "11.5.3" "11.6.0"
check_branch "11.4.3" "11.5.0"
check_branch "11.3.5" "11.4.0"
check_branch "11.2.8" "11.3.0"

# If we reach here with a version in [11.1.0, ...) it is vulnerable
echo "VULNERABLE - Version ${VERSION} is affected by CVE-2025-2703 (Grafana XY Chart DOM XSS)"
exit 1

1. Tenable Plugin 241364
2. Grafana Security Advisory — CVE-2025-2703
3. Grafana Security Release Blog (CVE-2025-3260, CVE-2025-2703, CVE-2025-3454)
4. SonarSource — Data in Danger: Detecting XSS in Grafana
5. FIRST.org EPSS API — CVE-2025-2703
6. Grafana at Internet Scale — 603K Exposed Instances
7. NVD — CVE-2025-2703
8. Red Hat CVE Page — CVE-2025-2703