A Vulnerability in Grafana Could Allow for Arbitrary Code Execution

A cross-site scripting vulnerability in Grafana (CVE-2025-4123) results from a combination of client path traversal and an open redirect, allowing attackers to redirect users to malicious frontend plugins that execute arbitrary JavaScript. The flaw does not require editor permissions and works with anonymous access; if the Grafana Image Renderer plugin is installed it can be escalated to a full read SSRF, potentially enabling plugin execution and user account takeover, including against local instances via crafted payloads.