The vulnerability in Grafana OSS 12.4.0 involves the geomap panel's XYZ tile layer, where the function sanitizeTextPanelContent() sanitizes the raw template string before getTemplateSrv().replace() substitutes variable values. Since the substitution uses a glob format without HTML escaping, malicious input can be injected and passed to OpenLayers via element.innerHTML, enabling an editor to set a textbox variable's default value to an XSS payload. This flaw bypasses the prior CVE-2023-0507 fix and results in cross-site scripting that executes when any user views the dashboard.

Successful exploitation allows an editor to inject and execute arbitrary JavaScript code in the context of any user viewing the affected dashboard, leading to potential compromise of user sessions, data theft, or other malicious actions. The vulnerability requires editor privileges to set the malicious variable but affects all users who open the dashboard. There is no indication of denial of service or impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor privileges to trusted users only to prevent injection of malicious variable values. Monitor vendor communications for updates on patches or official mitigations.