Trailerb18

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A sanitize-then-interpolate ordering bug exists in the geomap panel's XYZ tile layer. The `sanitizeTextPanelContent()` function processes the raw template string before `getTemplateSrv().replace()` substitutes the variable value. Because the substitution uses the glob format without HTML escaping, the final result is passed to OpenLayers via `element.innerHTML`. This allows an Editor to set a textbox variable's default value to a Cross-Site Scripting (XSS) payload, which then executes for every user who opens the dashboard. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.