CVE-2026-17033: CWE-79: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') in Grafana Grafana OSS

This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Grafana OSS. An attacker authorized to create external alerts can submit an alert containing a specially crafted generatorURL. Grafana renders this URL directly as the href attribute of the 'See source' LinkButton without sanitizing the URL scheme or enforcing a safe-protocol allowlist. The click interceptor's heuristic to block unsafe schemes can be bypassed by embedding :// inside a JavaScript comment, enabling execution of attacker-controlled JavaScript when a user clicks the link. This results in script execution with the privileges of the clicking user within the Grafana origin.

Successful exploitation allows execution of attacker-controlled JavaScript in the context of a victim user's Grafana session, potentially leading to unauthorized actions or data exposure with the victim's permissions. The attacker must have Editor access or alert.instances.external:write permission to submit the malicious alert, and the victim must have read access and click the crafted 'See source' link. The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor and alert.instances.external:write permissions to trusted users only. Educate users to be cautious when clicking 'See source' links in alerts from untrusted sources. Monitor vendor communications for official patches or updates addressing this vulnerability.