{"id":"CVE-2025-1088","published":"2025-06-18T09:54:30Z","modified":"2025-11-23T15:34:20Z","title":"Very long unicode dashboard title or panel name can hang the frontend","vendor":"Grafana","product":"Grafana","tier":"tail","description":{"text":"In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.\nThis issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00466,"percentile":0.40237,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2025-1088/","tags":[]}],"priority":{"score":9.9,"factors":[{"name":"EPSS percentile","points":8.05},{"name":"CVSS severity","points":1.89}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":["< 11.6.2"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=0.0.1-test, <11.6.2","<0.0.0-20250521211231-e0ba4b480954",">=0.0.1-test"],"patched":["11.6.2","0.0.0-20250521211231-e0ba4b480954"],"from":["GHSA-crvv-6w6h-cv34","GO-2025-3766"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-18570","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-3260","published":"2025-06-02","fixed":"0.0.0-20250521183405-c7a690348df7","kev":false,"link":{"from":"CVE-2025-3260","to":"CVE-2025-1088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"0.0.0-20250521183405-c7a690348df7","toFixed":"0.0.0-20250521211231-e0ba4b480954","daysApart":16}]}},{"cve":"CVE-2024-6322","published":"2024-08-20","fixed":"11.1.3","kev":false},{"cve":"CVE-2024-9264","published":"2024-10-18","fixed":"11.2.2+security-01","kev":false},{"cve":"CVE-2024-11741","published":"2025-01-31","fixed":"11.4.1","kev":false,"link":{"from":"CVE-2024-11741","to":"CVE-2025-1088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.4.1","toFixed":"11.6.2","daysApart":138}]}},{"cve":"CVE-2025-1088","published":"2025-06-18","fixed":"11.6.2","kev":false},{"cve":"CVE-2025-41115","published":"2025-11-21","fixed":"12.2.2","kev":false},{"cve":"CVE-2025-41117","published":"2026-02-12","fixed":"12.3.3","kev":false},{"cve":"CVE-2026-27877","published":"2026-03-27","fixed":"12.4.2","kev":false,"link":{"from":"CVE-2025-1088","to":"CVE-2026-27877","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.6.2","toFixed":"11.6.14","daysApart":282}]}}],"package":"Go:github.com/grafana/grafana"}}