This vulnerability (CWE-79) in Grafana OSS allows an attacker with Editor permissions to craft a dashboard whose TableNG panel includes a malicious field name. When other users view this dashboard, the embedded script executes in their browsers, resulting in stored cross-site scripting. The CVSS v3.1 base score is 6.8, reflecting network attack vector, low attack complexity, required privileges of Editor, user interaction needed, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. No official patch or remediation level has been published as of the data provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session. This can result in disclosure of sensitive information (high confidentiality impact), limited modification of data (low integrity impact), and minor disruption of service (low availability impact). The attacker requires Editor privileges and user interaction (viewing the dashboard) to trigger the vulnerability.

No official fix or patch is currently available or confirmed. Users should restrict Editor permissions to trusted users only and avoid viewing dashboards from untrusted sources. Monitor vendor advisories for updates regarding patches or official remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.