BIT-prometheus-2026-44903: Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
A stored cross-site scripting (XSS) vulnerability exists in the legacy Prometheus web UI's heatmap chart view. The issue arises because histogram bucket label values are not properly escaped when rendered as axis tick mark labels in HTML. An attacker able to inject crafted metrics can execute arbitrary JavaScript in the browsers of users viewing the affected heatmap UI. This vulnerability affects multiple Prometheus versions prior to 3.5.3 and 3.11.3 where the legacy UI is enabled. The issue is fixed in versions 3.5.3 and 3.11.3.
AI Analysis
Technical Summary
Prometheus versions from 2.49.0 up to but not including 3.5.3, and from 3.6.0 up to but not including 3.11.3, contain a stored XSS vulnerability in the legacy web UI heatmap chart. The vulnerability occurs because the histogram heatmap chart view does not escape label values when inserting them into HTML axis tick mark labels. An attacker who can inject specially crafted metrics can cause arbitrary JavaScript execution in any Prometheus user's browser who views the heatmap chart. This issue is resolved in Prometheus versions 3.5.3 and 3.11.3.
Potential Impact
Successful exploitation allows an attacker with the ability to inject metrics to execute arbitrary JavaScript in the browsers of users viewing the legacy Prometheus heatmap UI. This could lead to session hijacking, credential theft, or other client-side attacks within the context of the Prometheus web interface. The vulnerability requires the legacy UI to be enabled and the attacker to have metric injection capability.
Mitigation Recommendations
This vulnerability is fixed in Prometheus versions 3.5.3 and 3.11.3. Users should upgrade to at least one of these versions to remediate the issue. If upgrading is not immediately possible, disabling the legacy web UI (by not enabling the --enable-feature=old-ui flag) will prevent exposure to this vulnerability. Patch status is confirmed fixed in the specified versions.
BIT-prometheus-2026-44903: Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI
Description
A stored cross-site scripting (XSS) vulnerability exists in the legacy Prometheus web UI's heatmap chart view. The issue arises because histogram bucket label values are not properly escaped when rendered as axis tick mark labels in HTML. An attacker able to inject crafted metrics can execute arbitrary JavaScript in the browsers of users viewing the affected heatmap UI. This vulnerability affects multiple Prometheus versions prior to 3.5.3 and 3.11.3 where the legacy UI is enabled. The issue is fixed in versions 3.5.3 and 3.11.3.
Affected software
pkg:bitnami/prometheusRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Prometheus versions from 2.49.0 up to but not including 3.5.3, and from 3.6.0 up to but not including 3.11.3, contain a stored XSS vulnerability in the legacy web UI heatmap chart. The vulnerability occurs because the histogram heatmap chart view does not escape label values when inserting them into HTML axis tick mark labels. An attacker who can inject specially crafted metrics can cause arbitrary JavaScript execution in any Prometheus user's browser who views the heatmap chart. This issue is resolved in Prometheus versions 3.5.3 and 3.11.3.
Potential Impact
Successful exploitation allows an attacker with the ability to inject metrics to execute arbitrary JavaScript in the browsers of users viewing the legacy Prometheus heatmap UI. This could lead to session hijacking, credential theft, or other client-side attacks within the context of the Prometheus web interface. The vulnerability requires the legacy UI to be enabled and the attacker to have metric injection capability.
Mitigation Recommendations
This vulnerability is fixed in Prometheus versions 3.5.3 and 3.11.3. Users should upgrade to at least one of these versions to remediate the issue. If upgrading is not immediately possible, disabling the legacy web UI (by not enabling the --enable-feature=old-ui flag) will prevent exposure to this vulnerability. Patch status is confirmed fixed in the specified versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-prometheus-2026-44903
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-44903"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a577ed068715ace43b3f49c
Added to database: 07/15/2026, 12:36:32 UTC
Last enriched: 07/15/2026, 12:42:16 UTC
Last updated: 07/18/2026, 17:31:43 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.