This vulnerability (CWE-79) allows an Editor-level user in Grafana OSS to insert malicious JavaScript code into the attribution field of a Geomap panel's XYZ tile layer via a template variable. The injected script is stored and executed in the context of any user who views the affected dashboard, resulting in stored cross-site scripting. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, required privileges of Editor, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No official remediation or patch information is provided in the available data.

Successful exploitation allows an attacker with Editor permissions to execute arbitrary scripts in the browsers of users viewing the affected dashboard. This can lead to disclosure or modification of sensitive information accessible in the user's session context. There is no indication of availability impact. The vulnerability affects confidentiality and integrity with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor permissions to trusted users only and consider reviewing dashboards for suspicious template variables in Geomap panels. Monitor vendor communications for updates on official patches or mitigations.