Launchpad.net

CVE 2019-13068

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

See the CVE page on Mitre.org for more details.