{"id":"CVE-2026-32117","aliases":["EUVD-2026-11407","GHSA-q6fh-6m3m-5948"],"status":"published","title":"grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)","description":"The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00307,"percentile":0.23752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-03-11T21:28:38Z","modified":"2026-11-11T10:31:03Z","products":[{"vendor":"ekacnet","product":"grafanacubism-panel"}],"references":[{"url":"https://github.com/ekacnet/grafanacubism-panel/security/advisories/GHSA-q6fh-6m3m-5948","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/ekacnet/grafanacubism-panel/commit/b79cbf7e5eb3225bb204bcef274e15e6b19d9926","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32117.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32117","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32117","title":"grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)","description":"The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.","status":"published","published":"2026-03-11T21:28:38.122Z","modified":"2026-03-12T19:29:56.17Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11407","description":"The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.","status":"published","published":"2026-03-11T21:28:38Z","modified":"2026-03-12T19:29:56Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:35.78849Z"}],"nvd":[{"id":"CVE-2026-32117","description":"The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.","status":"published","published":"2026-03-11T22:16:32.473Z","modified":"2026-06-17T10:35:09.957Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-32117","title":"grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)","description":"The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign() / window.open() with no scheme validation. An attacker with dashboard Editor privileges can set the link to a javascript: URI; when any Viewer drag-zooms on the panel, the payload executes in the Grafana origin.","status":"published","published":"2026-03-11T21:28:38.122Z","modified":"2026-11-11T10:31:03.338275762Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T11:06:43.834798Z"}]}}