The vulnerability in Grafana 2.6.0+dfsg-1 allows users with Editor permissions to inject malicious JavaScript code into the attribution field of a Geomap panel's XYZ tile layer via template variables. This stored cross-site scripting (XSS) vulnerability results in script execution in the browsers of any users who view the compromised dashboard. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges (Editor role), user interaction needed, unchanged scope, and high confidentiality and integrity impacts with no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected user's browser, compromising confidentiality and integrity of user data and sessions. This may allow theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the user. There is no direct impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor permissions to trusted users only and avoid using template variables in the attribution field of Geomap panels. Monitor vendor communications for patches or updates addressing this vulnerability.