CVE-2019-3826: Prometheus XSS Vulnerability
Summary
GHSA-3m87-5598-2v4f: Withdrawn Advisory: Prometheus XSS Vulnerability. Affects github.com/prometheus/prometheus versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prometheus is an open-source monitoring and alerting toolkit designed for large-scale distributed systems. It provides a flexible query language, powerful visualizations, and extensive support for integrations. The vulnerability in question affects versions prior to 2.7.1 of the Prometheus package. Prometheus is written in Go and is widely used in various applications and environments.
Vulnerability Detail
The vulnerability identified as CVE-2019-3826 is a stored, DOM-based, cross-site scripting (XSS) flaw in Prometheus. This vulnerability allows an attacker to execute arbitrary scripts and store them persistently. To exploit this vulnerability, an authenticated user must be convinced to visit a specially crafted URL on a Prometheus server. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of malicious actions within the affected system.
How To Fix
Latest published version: v0.315.1 as of 23 Oct 2026
go get github.com/prometheus/prometheus@v0.315.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
go get github.com/prometheus/prometheus@v2.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Prometheus to a patched version.
Conclusion
The Prometheus XSS vulnerability (CVE-2019-3826) poses a moderate risk to systems running affected versions of Prometheus. It is crucial to upgrade to version 2.7.1 or later to mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/prometheus/prometheus →
FAQ
Prometheus is an open-source monitoring and alerting toolkit designed for large-scale distributed systems. It provides powerful querying capabilities, visualization tools, and extensive integrations.
The vulnerability allows an attacker to execute arbitrary scripts and store them persistently. This can lead to unauthorized access to sensitive information and the execution of malicious actions within the affected system.
To fix this vulnerability, it is recommended to upgrade Prometheus to version 2.7.1 or later. This version includes the necessary patches to address the XSS flaw.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Prometheus to a patched version.
For more information about this vulnerability, you can refer to the official GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-3m87-5598-2v4f/GHSA-3m87-5598-2v4f.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/prometheus/prometheus.
