Skip to content

ui: fix stored XSS in old UI heatmap chart tick labels#18589

Merged
roidelapluie merged 1 commit into
prometheus:release-3.5from
roidelapluie:roidelapluie/react-escape-lts
Apr 27, 2026
Merged

ui: fix stored XSS in old UI heatmap chart tick labels#18589
roidelapluie merged 1 commit into
prometheus:release-3.5from
roidelapluie:roidelapluie/react-escape-lts

Conversation

@roidelapluie
Copy link
Copy Markdown
Member

@roidelapluie roidelapluie commented Apr 27, 2026

This fixes the stored XSS as described in:

GHSA-fw8g-cg8f-9j28

Which issue(s) does the PR fix:

Release notes for end users (ALL commits must be considered).

Reviewers should verify clarity and quality.

[SECURITY] UI: Fix stored XSS via unescaped `le` label values in old UI heatmap chart tick labels.

This fixes the stored XSS as described in:

GHSA-fw8g-cg8f-9j28

Signed-off-by: Julius Volz <julius.volz@gmail.com>
Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
@roidelapluie roidelapluie requested review from a team and juliusv as code owners April 27, 2026 10:31
Copy link
Copy Markdown
Member

@krajorama krajorama left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

stamp

@roidelapluie roidelapluie merged commit b2b977c into prometheus:release-3.5 Apr 27, 2026
56 of 57 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants