Grafana versions 12.2.0 through before 12.2.5 and 12.3.0 through before 12.3.3 have a cross-site scripting (XSS) vulnerability in the Explore Traces view. This occurs because stack traces can be rendered as raw HTML, allowing malicious JavaScript injection if an attacker can insert JavaScript into the stack trace field. The issue affects only datasources using the Jaeger HTTP API; Jaeger gRPC and Tempo datasources are not affected. A patch is available in versions 12.2.5 and 12.3.3.