This vulnerability is a stored cross-site scripting (CWE-79) in the Geomap panel's MapLibre base layer of Grafana OSS. An attacker with Editor privileges can inject malicious JavaScript by hosting a crafted style configuration. When another user loads this configuration, the script executes in their session, potentially allowing privilege escalation to Org Admin. The vulnerability affects specific versions of Grafana OSS as listed, with a CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). No known exploits in the wild have been reported, and no patch links were provided in the source data.

Successful exploitation allows an attacker with Editor role to execute arbitrary JavaScript in the context of another user's session, leading to high confidentiality and integrity impact by enabling escalation to Org Admin privileges. This can compromise the affected Grafana instance's security and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links were provided, users should monitor Grafana's official channels for updates. In the meantime, restrict Editor role assignments to trusted users and consider limiting access to the Geomap panel or disabling it if feasible until a fix is available.