CVE-2026-9029

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A sanitize-then-interpolate ordering bug exists in the geomap panel's XYZ tile layer. The sanitizeTextPanelContent() function processes the raw template string before getTemplateSrv().replace() substitutes the variable value. Because the substitution uses the glob format without HTML escaping, the final result is passed to OpenLayers via element.innerHTML. This allows an Editor to set a textbox variable's default value to a Cross-Site Scripting (XSS) payload, which then executes for every user who opens the dashboard.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.