fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security] (release-v2.9) by renovate-sh-app[bot] · Pull Request #6956 · grafana/tempo

renovate-sh-app · 2026-04-13T17:53:53Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/prometheus	`v0.304.2` → `v0.311.2`

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

BIT-prometheus-2026-40179 / CVE-2026-40179 / GHSA-vffh-x6r8-xx99

More information

Details

Impact

Stored cross-site scripting (XSS) via crafted metric names in the Prometheus web UI:

Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
Old React UI only: When a user opens the Metric Explorer (globe icon next to the PromQL expression input field), and a metric name containing HTML/JavaScript is rendered in the fuzzy search results, it is injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
Old React UI only: When a user views a heatmap chart and hovers over a cell, the le label values of the underlying histogram buckets are interpolated into innerHTML without escaping. While le is conventionally a numeric bucket boundary, Prometheus does not enforce this — arbitrary UTF-8 strings are accepted as label values, allowing script injection via a crafted scrape target or remote write.

With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels, making this exploitable.

An attacker who can inject metrics (via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the Graph UI. From the XSS context, an attacker could for example:

Read /api/v1/status/config to extract sensitive configuration (although credentials / secrets are redacted by the server)
Call /-/quit to shut down Prometheus (only if --web.enable-lifecycle is set)
Call /api/v1/admin/tsdb/delete_series to delete data (only if --web.enable-admin-api is set)
Exfiltrate metric data to an external server

Both the new Mantine UI and the old React UI are affected. The vulnerable code paths are:

web/ui/mantine-ui/src/pages/query/uPlotChartHelpers.ts — tooltip innerHTML with unescaped labels.__name__
web/ui/react-app/src/pages/graph/GraphHelpers.ts — tooltip content with unescaped labels.__name__
web/ui/react-app/src/pages/graph/MetricsExplorer.tsx — fuzzy search results rendered via dangerouslySetInnerHTML without sanitization
web/ui/react-app/src/vendor/flot/jquery.flot.heatmap.js — heatmap tooltip with unescaped label values

Patches

A patch has been published in Prometheus 3.5.2 LTS and Prometheus 3.11.2. The fix applies escapeHTML() to all user-controlled values (metric names and label values) before inserting them into innerHTML. This advisory will be updated with the patched version once released.

Workarounds

If using the remote write receiver (--web.enable-remote-write-receiver), ensure it is not exposed to untrusted sources.
If using the OTLP receiver (--web.enable-otlp-receiver), ensure it is not exposed to untrusted sources.
Ensure scrape targets are trusted and not under attacker control.
Do not enable admin / mutating API endpoints (e.g. --web.enable-admin-api or web.enable-lifecycle) in cases where you cannot prevent untrusted data from being ingested.
Users should avoid clicking untrusted links, especially those containing functions such as label_replace, as they may generate poisoned label names and values.

Acknowledgements

Thanks to @gladiator9797 (Duc Anh Nguyen from TinyxLab) for reporting this.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

prometheus/prometheus (github.com/prometheus/prometheus)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

renovate-sh-app · 2026-04-13T17:53:59Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0
go: downloading github.com/grafana/dskit v0.0.0-20250828173137-de14cf923eeb
go: downloading github.com/alecthomas/kong v1.12.1
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger v0.132.0
go: downloading github.com/grafana/e2e v0.1.2-0.20250428181430-708d63bcc673
go: downloading go.opentelemetry.io/collector v0.132.0
go: downloading github.com/mark3labs/mcp-go v0.37.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter v0.132.0
go: downloading github.com/parquet-go/parquet-go v0.25.2-0.20250911172247-41fe9a8fbd81
go: downloading go.opentelemetry.io/collector/config/configgrpc v0.132.0
go: downloading go.opentelemetry.io/collector/config/confighttp v0.132.0
go: downloading go.opentelemetry.io/collector/config/configtls v1.38.0
go: downloading go.opentelemetry.io/collector/exporter v0.132.0
go: downloading go.opentelemetry.io/collector/exporter/otlpexporter v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/ottl v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver v0.132.0
go: downloading go.opentelemetry.io/collector/client v1.54.0
go: downloading go.opentelemetry.io/collector/exporter/exportertest v0.132.0
go: downloading go.opentelemetry.io/collector/otelcol v0.132.0
go: downloading go.opentelemetry.io/collector/receiver v1.38.0
go: downloading go.opentelemetry.io/collector/receiver/otlpreceiver v0.132.0
go: downloading go.opentelemetry.io/collector/config/configopaque v1.38.0
go: downloading go.opentelemetry.io/collector/exporter/otlphttpexporter v0.132.0
go: downloading github.com/grafana/gomemcache v0.0.0-20250828162811-a96f6acee2fe
go: downloading github.com/alicebob/miniredis/v2 v2.35.0
go: downloading go.opentelemetry.io/contrib/exporters/autoexport v0.62.0
go: downloading github.com/prometheus/procfs v0.17.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/core/xidutils v0.132.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2
go: downloading github.com/grafana/memberlist v0.3.1-0.20220708130638-bd88e10a3d91
go: downloading github.com/minio/minio-go/v7 v7.0.94
go: downloading github.com/grafana/pyroscope-go/godeltaprof v0.1.8
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/zipkin v0.132.0
go: downloading go.opentelemetry.io/collector/config/configretry v1.38.0
go: downloading go.opentelemetry.io/collector/consumer/consumererror v0.132.0
go: downloading go.opentelemetry.io/collector/config/configauth v0.132.0
go: downloading go.opentelemetry.io/collector/config/configcompression v1.38.0
go: downloading go.opentelemetry.io/collector/config/configmiddleware v0.132.0
go: downloading go.opentelemetry.io/collector/config/confignet v1.38.0
go: downloading go.opentelemetry.io/collector/config/configoptional v0.132.0
go: downloading go.opentelemetry.io/collector/extension/extensionauth v1.38.0
go: downloading github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e
go: downloading github.com/google/go-tpm v0.9.5
go: downloading go.opentelemetry.io/collector/receiver/receiverhelper v0.132.0
go: downloading go.opentelemetry.io/collector/exporter/exporterhelper/xexporterhelper v0.132.0
go: downloading go.opentelemetry.io/collector/exporter/xexporter v0.132.0
go: downloading go.opentelemetry.io/collector/extension v1.38.0
go: downloading go.opentelemetry.io/collector/receiver/receivertest v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/internal/filter v0.132.0
go: downloading go.opentelemetry.io/collector/processor/processorhelper v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/internal/sharedcomponent v0.132.0
go: downloading go.opentelemetry.io/collector/internal/sharedcomponent v0.132.0
go: downloading go.opentelemetry.io/collector/internal/telemetry v0.132.0
go: downloading go.opentelemetry.io/collector/receiver/xreceiver v0.132.0
go: downloading go.opentelemetry.io/contrib/samplers/jaegerremote v0.31.0
go: downloading go.opentelemetry.io/collector/connector v0.132.0
go: downloading go.opentelemetry.io/collector/service v0.132.0
go: downloading go.opentelemetry.io/contrib/bridges/prometheus v0.62.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.13.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/prometheus v0.59.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.13.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.37.0
go: downloading github.com/IBM/sarama v1.45.2
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/internal/kafka v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/kafka/configkafka v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/azure v0.132.0
go: downloading github.com/hashicorp/go-msgpack v0.5.5
go: downloading go.opentelemetry.io/collector/pdata/xpdata v0.148.0
go: downloading go.opentelemetry.io/collector/extension/extensionmiddleware v0.132.0
go: downloading go.opentelemetry.io/collector/consumer/consumererror/xconsumererror v0.132.0
go: downloading go.opentelemetry.io/collector/pipeline/xpipeline v0.132.0
go: downloading github.com/open-telemetry/opentelemetry-collector-contrib/pkg/translator/opencensus v0.132.0
go: downloading go.opentelemetry.io/contrib/bridges/otelzap v0.12.0
go: downloading go.opentelemetry.io/collector/internal/fanoutconsumer v0.132.0
go: downloading go.opentelemetry.io/collector/config/configtelemetry v0.132.0
go: downloading go.opentelemetry.io/contrib/otelconf v0.17.0
go: downloading go.opentelemetry.io/contrib/propagators/b3 v1.37.0
go: downloading go.opentelemetry.io/collector/extension/xextension v0.132.0
go: downloading go.opentelemetry.io/collector/extension/extensioncapabilities v0.132.0
go: downloading go.opentelemetry.io/collector/connector/connectortest v0.132.0
go: downloading go.opentelemetry.io/collector/connector/xconnector v0.132.0
go: downloading go.opentelemetry.io/collector/extension/extensiontest v0.132.0
go: downloading go.opentelemetry.io/collector/service/hostcapabilities v0.132.0
go: downloading github.com/shirou/gopsutil/v4 v4.25.7
go: downloading github.com/tinylib/msgp v1.3.0
go: downloading github.com/tklauser/go-sysconf v0.3.15
go: downloading github.com/ebitengine/purego v0.8.4
go: downloading github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c
go: downloading github.com/tklauser/numcpus v0.10.0
go: github.com/grafana/tempo/modules/generator/storage imports
	github.com/prometheus/prometheus/tsdb/errors: cannot find module providing package github.com/prometheus/prometheus/tsdb/errors
go: module github.com/aws/aws-sdk-go is deprecated: aws-sdk-go is deprecated. Use aws-sdk-go-v2.
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.
go: module github.com/open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver is deprecated: this receiver is no longer maintained and has reached end-of-life. See https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/36791
go: warning: go.opentelemetry.io/otel/exporters/prometheus@v0.59.0: retracted by module author: v0.59.0 produces incorrect metric names when bracketed units are used.
go: to switch to the latest unretracted version, run:
	go get go.opentelemetry.io/otel/exporters/prometheus@latest

… [security] | datasource | package | from | to | | ---------- | -------------------------------- | -------- | -------- | | go | github.com/prometheus/prometheus | v0.304.2 | v0.311.2 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

renovate-sh-app Bot added dependencies Pull requests that update a dependency file gomod minor renovate Applied to PR's created by renovatebot labels Apr 13, 2026

renovate-sh-app Bot requested a review from joe-elliott as a code owner April 13, 2026 17:53

renovate-sh-app Bot added security update-minor labels Apr 13, 2026

renovate-sh-app Bot requested review from carles-grafana, electron0zero, ie-pham, javiermolinar, mapno, mattdurham, mdisibio, ruslan-mikhailov, stoewer, yvrhdn and zalegrala as code owners April 13, 2026 17:53

renovate-sh-app Bot enabled auto-merge (squash) April 13, 2026 17:53

renovate-sh-app Bot force-pushed the renovate/release-v2.9-go-github.tiyicn.workers.dev-prometheus-prometheus-vulnerability branch 7 times, most recently from 02ba99b to 2469edf Compare April 24, 2026 17:15

renovate-sh-app Bot force-pushed the renovate/release-v2.9-go-github.tiyicn.workers.dev-prometheus-prometheus-vulnerability branch from 2469edf to 6cfbe68 Compare April 24, 2026 20:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security] (release-v2.9)#6956

fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security] (release-v2.9)#6956
renovate-sh-app[bot] wants to merge 1 commit intorelease-v2.9from
renovate/release-v2.9-go-github.tiyicn.workers.dev-prometheus-prometheus-vulnerability

renovate-sh-app Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

renovate-sh-app Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate-sh-app Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Details

Impact

Patches

Workarounds

Acknowledgements

Severity

References

Release Notes

Configuration

Need help?

Uh oh!

renovate-sh-app Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate-sh-app Bot commented Apr 13, 2026 •

edited

Loading

renovate-sh-app Bot commented Apr 13, 2026 •

edited

Loading