Grafana HTML Injection Vulnerability in Jaeger HTTP API Datasources

A vulnerability exists in Grafana's Explore Traces view, where stack traces can be rendered as raw HTML. This flaw allows for the injection of malicious JavaScript into the browser. The issue arises only when harmful JavaScript is entered into the stack trace field. Currently, this vulnerability affects Grafana when using datasources that connect to the Jaeger HTTP API; those using Jaeger gRPC or Tempo do not experience this issue.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing injected JavaScript to be executed in the context of the user's browser.