{"action":"Upgrade github.com/grafana/grafana to 0.0.0-20250521183405-c7a690348df7 or later.","affected":[{"introduced":"0"}],"component":"github.com/grafana/grafana","cve_ids":["CVE-2025-4123"],"ecosystem":"Go","epss":0.97083,"exploited":false,"fixed_versions":["0.0.0-20250521183405-c7a690348df7"],"ghsa_id":"GHSA-q53q-gxq9-mgrj","id":"tcs_01M5KFJB5GDBBPS1TJ9VV3RFJC","modified_at":"2026-09-10T03:50:24.585134887Z","published_at":"2025-05-22T09:33:21Z","references":["https://osv.dev/vulnerability/GHSA-q53q-gxq9-mgrj","https://nvd.nist.gov/vuln/detail/CVE-2025-4123","https://github.com/grafana/grafana/commit/c7a690348df761d41b659224cbc50a46a0c0e4cc","https://github.com/grafana/grafana","https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580","https://grafana.com/security/security-advisories/cve-2025-4123","https://pkg.go.dev/vuln/GO-2025-3702","https://www.exploit-db.com/exploits/52491"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-q53q-gxq9-mgrj","url":"https://osv.dev/vulnerability/GHSA-q53q-gxq9-mgrj"}],"summary":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin"}