This vulnerability (CVE-2025-41117) in Grafana's Explore Traces view allows stack traces to be rendered as raw HTML, enabling cross-site scripting (XSS) via injection of malicious JavaScript. The flaw is limited to datasources that use the Jaeger HTTP API; other tracing datasources such as Jaeger gRPC and Tempo are not affected. The CVSS 3.1 score is 6.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, and user interaction needed. No known exploits are reported in the wild. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing affected stack traces, potentially leading to data theft, session hijacking, or other client-side impacts. However, exploitation requires that malicious JavaScript be inserted into the stack trace field and that a user interact with the affected Explore Traces view. The impact does not affect availability.

No official patch or fix is currently documented. Users should monitor vendor advisories for updates. Since exploitation requires malicious input in stack traces and user interaction, restricting access to trusted users and validating or sanitizing inputs before they reach the Explore Traces view may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.