This vulnerability (CVE-2025-41117) in Grafana's Explore Traces view allows an attacker to inject and execute malicious JavaScript by entering it into the stack trace field, which is rendered as raw HTML. The issue is limited to datasources using the Jaeger HTTP API; other tracing backends like Jaeger gRPC and Tempo are unaffected. The CVSS 3.1 base score is 6.8, reflecting medium severity with network attack vector, high complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity but no impact on availability. No patch or official fix has been documented in the provided data.

Successful exploitation could lead to cross-site scripting (XSS) attacks in the Grafana Explore Traces view, potentially allowing attackers to execute arbitrary JavaScript in the context of the user's browser. This can compromise confidentiality and integrity of user data accessible through the browser session. The vulnerability requires user interaction and high attack complexity, limiting the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when viewing traces from untrusted sources, especially those using the Jaeger HTTP API datasource. Avoid interacting with suspicious or unverified stack trace data in the Explore Traces view. Monitor Grafana's official channels for updates and patches addressing this vulnerability.