Vulnerability record · CVE-2021-41174 · published 3 November 2021
CVE-2021-41174: Grafana AngularJS template injection XSS via crafted URL
Grafana · Grafana
Grafana renders AngularJS interpolation bindings ({{ }}) from a crafted URL without validation, allowing arbitrary JavaScript execution in the victim's browser. The flaw is reachable by an unauthenticated visitor who follows a malicious link to a page containing the login button. It matters because it enables script execution in the Grafana origin, which can be used to steal session data or act on behalf of the user.
Description
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Automated analysis
high priorityCVSS is medium (6.1) but EPSS is very high and the flaw allows script execution in a widely deployed monitoring platform, warranting prompt remediation.
What it is
Grafana renders AngularJS interpolation bindings ({{ }}) from a crafted URL without validation, allowing arbitrary JavaScript execution in the victim's browser. The flaw is reachable by an unauthenticated visitor who follows a malicious link to a page containing the login button. It matters because it enables script execution in the Grafana origin, which can be used to steal session data or act on behalf of the user.
Impact
An attacker can execute arbitrary JavaScript in the context of the victim's browser session on the Grafana instance. This can lead to theft of session tokens or other client-side data and actions performed as the victim.
Attack surface
Reached over the network by convincing a victim to visit a crafted URL; the victim must be unauthenticated and the target page must contain the login button in the menu bar. Exploitation requires user interaction (clicking the link) and no authentication.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.854 probability, 99.7th percentile), indicating elevated likelihood of exploitation activity. References include patch commits and vendor advisories, but no public exploit tag is present in the record.
What to do
- Upgrade Grafana to a patched version as soon as possible.
- If upgrade is not possible, block requests containing the literal string {{ in the path using a reverse proxy or WAF.
- Restrict exposure of Grafana login pages to trusted networks where feasible.
- Monitor vendor advisories and apply subsequent security updates promptly.
Detection
- Search web/proxy logs for requests with {{ in the URL path or query string.
- Alert on AngularJS expression patterns such as constructor.constructor or alert( in request URIs.
- Review Grafana access logs for unusual redirects to the login page with encoded query parameters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-41174 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-41174), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
