StackRadarChart IndexLive demo

CVE-2023-0594

Medium

Advisory

Published 1 Mar 2023In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.092; 95th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4; of 17,781 indexed, latest versions
Container images: 2; deployed by those charts
Fix available: 1 of 1; affected package

Grafana vulnerable to Cross-site Scripting

Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
github.com/grafana/grafanagolang	v9.2.4, v9.3.1	9.2.13, 9.3.8	2

OSV records: GHSA-xw5p-hw8j-xg4q
Also known as: BIT-grafana-2023-0594

Charts affected

4 by stars

Chart

Latest

Affected images

Radar Score

carettagroundcover

1 of 3 See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2023-0594.

Container image	Digest	Package	Fixed in
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	9.3.8

Open the chart page →

6,799

drogue-cloud-examplesdrogue-iot

1 of 6 See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2023-0594.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	9.2.13

Open the chart page →

30,699

drogue-cloud-metricsdrogue-iot

1 of 8 See more

drogue-cloud-metrics drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2023-0594.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	9.2.13

Open the chart page →

13,558

npre-essentialsphntom

1 of 22 See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2023-0594.

Container image	Digest	Package	Fixed in
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	9.3.8

Open the chart page →

26,840

Container images carrying it

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :9.2.4	057896e23443	github.com/grafana/grafana@v9.2.4	9.2.13	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	github.com/grafana/grafana@v9.3.1	9.3.8	2