Security Advisory

CVE-2026-32117

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-11 21:28:38

Last updated 2026-03-12 19:29:56

Assigner GitHub_M

State PUBLISHED

Description

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panels zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.

← Browse all CVEs View on cve.org ↗