{"action":"Upgrade github.com/prometheus/prometheus to 0.311.3 or later.","affected":[{"fixed":"0.311.3","introduced":"0"}],"component":"github.com/prometheus/prometheus","cve_ids":["CVE-2026-44903"],"ecosystem":"Go","epss":0.00204,"exploited":false,"fixed_versions":["0.311.3"],"ghsa_id":"GHSA-fw8g-cg8f-9j28","id":"tcs_01M5KF9WZ8QM7T7HRAY9KZJWGV","modified_at":"2026-09-10T03:51:05.550181165Z","published_at":"2026-05-05T21:53:18Z","references":["https://osv.dev/vulnerability/GHSA-fw8g-cg8f-9j28","https://github.com/prometheus/prometheus/security/advisories/GHSA-fw8g-cg8f-9j28","https://nvd.nist.gov/vuln/detail/CVE-2026-44903","https://github.com/prometheus/prometheus/commit/38f23b9075ced1de2b82d2dad8b2bebb1ecd5b7d","https://github.com/prometheus/prometheus"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-fw8g-cg8f-9j28","url":"https://osv.dev/vulnerability/GHSA-fw8g-cg8f-9j28"}],"summary":"Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display"}