An authenticated attacker with Editor access or alert.instances.external:write permission in Grafana can create an external Alertmanager alert with a controlled generatorURL. Grafana renders this URL directly as the href attribute of the 'See source' LinkButton without sanitizing the URL scheme or enforcing a safe-protocol allowlist. The click interceptor's heuristic to block dangerous schemes using :// can be bypassed by embedding :// inside a JavaScript comment. Consequently, when a user with read access clicks the 'See source' link, the browser executes attacker-controlled JavaScript in the context of the Grafana origin with the clicking user's permissions, resulting in a stored cross-site scripting vulnerability (CWE-79).

Successful exploitation allows execution of attacker-controlled JavaScript in the Grafana origin with the permissions of the user who clicks the malicious link. This can lead to data exposure or actions performed with the victim's privileges. The attacker must have Editor or alert.instances.external:write permissions to create the malicious alert, and the victim must have read access and click the 'See source' link. The CVSS score is 6.8 (medium severity), reflecting the need for user interaction and limited privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor and alert.instances.external:write permissions to trusted users only. Educate users to be cautious when clicking 'See source' links in alerts from untrusted sources. Monitor vendor advisories for updates on official patches or mitigations.