CVE-2026-9029: Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
(updated )
The geomap panel’s XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable’s default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
References
- github.com/advisories/GHSA-9g84-39mm-q4p3
- github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1
- github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29
- github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4
- github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58
- github.com/grafana/grafana/releases/tag/v12.4.4
- github.com/grafana/grafana/releases/tag/v13.0.2
- grafana.com/security/security-advisories/cve-2026-9029
- nvd.nist.gov/vuln/detail/CVE-2026-9029
Code Behaviors & Features
Detect and mitigate CVE-2026-9029 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →