This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Grafana OSS. Specifically, the alert.generatorURL field from an external Alertmanager alert is rendered directly as the href attribute of the 'See source' LinkButton without adequate URL-scheme sanitization or a safe-protocol allowlist. An attacker with Editor or alert.instances.external:write permissions can craft a generatorURL that bypasses the click interceptor's :// heuristic by embedding :// inside a JavaScript comment. When a user with read access clicks the 'See source' link, the browser executes attacker-controlled JavaScript within the Grafana origin, leveraging the victim's permissions. The attacker is authorized to create the alert but not to execute scripts in other users' sessions directly; the exploitation requires user interaction.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's Grafana session when they click the malicious 'See source' link. This can lead to partial confidentiality impact (C), limited integrity impact (I), and limited availability impact (A) as per the CVSS vector. The attacker must have Editor or alert.instances.external:write permissions to submit the malicious alert, and the victim must have read access and click the link for the script to execute.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor and alert.instances.external:write permissions to trusted users only. Educate users to be cautious when clicking 'See source' links in alerts. Monitor vendor communications for updates and apply official patches once released.