fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security] by renovate[bot] · Pull Request #101 · peak-scale/observability-tenancy

renovate · 2026-04-13T18:08:52Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/prometheus	`v0.303.1` → `v0.311.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

CVE-2026-40179 / GHSA-vffh-x6r8-xx99

More information

Details

Impact

Stored cross-site scripting (XSS) via crafted metric names in the Prometheus web UI:

Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
Old React UI only: When a user opens the Metric Explorer (globe icon next to the PromQL expression input field), and a metric name containing HTML/JavaScript is rendered in the fuzzy search results, it is injected into innerHTML without escaping, causing arbitrary script execution in the user's browser.
Old React UI only: When a user views a heatmap chart and hovers over a cell, the le label values of the underlying histogram buckets are interpolated into innerHTML without escaping. While le is conventionally a numeric bucket boundary, Prometheus does not enforce this — arbitrary UTF-8 strings are accepted as label values, allowing script injection via a crafted scrape target or remote write.

With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels, making this exploitable.

An attacker who can inject metrics (via a compromised scrape target, remote write, or OTLP receiver endpoint) can execute JavaScript in the browser of any Prometheus user who views the metric in the Graph UI. From the XSS context, an attacker could for example:

Read /api/v1/status/config to extract sensitive configuration (although credentials / secrets are redacted by the server)
Call /-/quit to shut down Prometheus (only if --web.enable-lifecycle is set)
Call /api/v1/admin/tsdb/delete_series to delete data (only if --web.enable-admin-api is set)
Exfiltrate metric data to an external server

Both the new Mantine UI and the old React UI are affected. The vulnerable code paths are:

web/ui/mantine-ui/src/pages/query/uPlotChartHelpers.ts — tooltip innerHTML with unescaped labels.__name__
web/ui/react-app/src/pages/graph/GraphHelpers.ts — tooltip content with unescaped labels.__name__
web/ui/react-app/src/pages/graph/MetricsExplorer.tsx — fuzzy search results rendered via dangerouslySetInnerHTML without sanitization
web/ui/react-app/src/vendor/flot/jquery.flot.heatmap.js — heatmap tooltip with unescaped label values

Patches

A patch has been published in Prometheus 3.5.2 LTS and Prometheus 3.11.2. The fix applies escapeHTML() to all user-controlled values (metric names and label values) before inserting them into innerHTML. This advisory will be updated with the patched version once released.

Workarounds

If using the remote write receiver (--web.enable-remote-write-receiver), ensure it is not exposed to untrusted sources.
If using the OTLP receiver (--web.enable-otlp-receiver), ensure it is not exposed to untrusted sources.
Ensure scrape targets are trusted and not under attacker control.
Do not enable admin / mutating API endpoints (e.g. --web.enable-admin-api or web.enable-lifecycle) in cases where you cannot prevent untrusted data from being ingested.
Users should avoid clicking untrusted links, especially those containing functions such as label_replace, as they may generate poisoned label names and values.

Acknowledgements

Thanks to @gladiator9797 (Duc Anh Nguyen from TinyxLab) for reporting this.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

prometheus/prometheus (github.com/prometheus/prometheus)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

… [security]

renovate · 2026-04-13T18:08:55Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module github.com/prometheus/prometheus@v0.311.2 requires go >= 1.25.0; switching to go1.25.9
go: downloading go1.25.9 (linux/amd64)
go: downloading github.com/KimMachineGun/automemlimit v0.7.5
go: downloading go.uber.org/automaxprocs v1.6.0
go: downloading k8s.io/apimachinery v0.35.3
go: downloading k8s.io/client-go v0.35.3
go: downloading sigs.k8s.io/controller-runtime v0.21.0
go: downloading github.com/onsi/ginkgo/v2 v2.27.2
go: downloading github.com/onsi/gomega v1.38.2
go: downloading github.com/projectcapsule/capsule v0.10.5
go: downloading github.com/stretchr/testify v1.11.1
go: downloading k8s.io/kubectl v0.32.0
go: downloading k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
go: downloading github.com/caarlos0/env/v8 v8.0.0
go: downloading github.com/creasty/defaults v1.8.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/valyala/fasthttp v1.65.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading k8s.io/api v0.35.3
go: downloading github.com/golang/snappy v1.0.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/prometheus/prometheus v0.311.2
go: downloading github.com/grafana/loki/v3 v3.4.2
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading k8s.io/klog/v2 v2.140.0
go: downloading k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.0
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading github.com/go-logr/zapr v1.3.0
go: downloading go.uber.org/zap v1.27.1
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading golang.org/x/net v0.52.0
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading k8s.io/apiextensions-apiserver v0.33.4
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading github.com/andybalholm/brotli v1.2.0
go: downloading github.com/klauspost/compress v1.18.5
go: downloading github.com/valyala/bytebufferpool v1.0.0
go: downloading github.com/prometheus/common v0.67.5
go: downloading github.com/c2h5oh/datasize v0.0.0-20231215233829-aa82cc1e6500
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading github.com/grafana/loki/pkg/push v0.0.0-20240924133635-758364c7775f
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b
go: downloading google.golang.org/grpc v1.79.3
go: downloading github.com/grafana/regexp v0.0.0-20250905093917-f7b3be9d1853
go: downloading golang.org/x/text v0.35.0
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/procfs v0.16.1
go: downloading golang.org/x/sys v0.42.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading golang.org/x/term v0.41.0
go: downloading golang.org/x/time v0.15.0
go: downloading golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
go: downloading github.com/go-kit/log v0.2.1
go: downloading github.com/grafana/dskit v0.0.0-20241007172036-53283a0f6b41
go: downloading github.com/uber/jaeger-client-go v2.30.0+incompatible
go: downloading go.uber.org/atomic v1.11.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c
go: downloading gomodules.xyz/jsonpatch/v2 v2.5.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading github.com/go-openapi/jsonreference v0.21.4
go: downloading github.com/go-openapi/swag v0.25.4
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading golang.org/x/tools v0.42.0
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/Masterminds/sprig/v3 v3.3.0
go: downloading github.com/grafana/jsonparser v0.0.0-20241004153430-023329977675
go: downloading go4.org/netipx v0.0.0-20230125063823-8449b0a6169f
go: downloading github.com/edsrzf/mmap-go v1.2.0
go: downloading github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb
go: downloading go.opentelemetry.io/otel v1.42.0
go: downloading go.opentelemetry.io/otel/trace v1.42.0
go: downloading github.com/go-logfmt/logfmt v0.6.0
go: downloading github.com/gogo/googleapis v1.4.1
go: downloading github.com/gogo/status v1.1.1
go: downloading github.com/grafana/gomemcache v0.0.0-20240229205252-cd6a66d6fb56
go: downloading github.com/redis/go-redis/v9 v9.7.0
go: downloading github.com/sony/gobreaker/v2 v2.1.0
go: downloading github.com/uber/jaeger-lib v2.4.1+incompatible
go: downloading github.com/dennwc/varint v1.0.0
go: downloading github.com/stretchr/objx v0.5.2
go: downloading github.com/google/btree v1.1.3
go: downloading golang.org/x/sync v0.20.0
go: downloading github.com/go-openapi/jsonpointer v0.22.5
go: downloading github.com/go-openapi/swag/cmdutils v0.25.4
go: downloading github.com/go-openapi/swag/conv v0.25.4
go: downloading github.com/go-openapi/swag/fileutils v0.25.4
go: downloading github.com/go-openapi/swag/jsonname v0.25.5
go: downloading github.com/go-openapi/swag/jsonutils v0.25.4
go: downloading github.com/go-openapi/swag/loading v0.25.4
go: downloading github.com/go-openapi/swag/mangling v0.25.4
go: downloading github.com/go-openapi/swag/netutils v0.25.4
go: downloading github.com/go-openapi/swag/stringutils v0.25.4
go: downloading github.com/go-openapi/swag/typeutils v0.25.4
go: downloading github.com/go-openapi/swag/yamlutils v0.25.4
go: downloading github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
go: downloading dario.cat/mergo v1.0.1
go: downloading github.com/Masterminds/goutils v1.1.1
go: downloading github.com/huandu/xstrings v1.5.0
go: downloading github.com/mitchellh/copystructure v1.2.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/spf13/cast v1.7.0
go: downloading golang.org/x/crypto v0.49.0
go: downloading go.opentelemetry.io/otel/metric v1.42.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b
go: downloading github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f
go: downloading github.com/go-redsync/redsync/v4 v4.13.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/opentracing-contrib/go-stdlib v1.1.0
go: downloading github.com/grafana/pyroscope-go/godeltaprof v0.1.8
go: downloading github.com/opentracing-contrib/go-grpc v0.1.1
go: downloading github.com/pires/go-proxyproto v0.7.0
go: downloading github.com/prometheus/exporter-toolkit v0.15.1
go: downloading github.com/armon/go-metrics v0.4.1
go: downloading github.com/hashicorp/go-sockaddr v1.0.7
go: downloading github.com/hashicorp/memberlist v0.5.1
go: downloading golang.org/x/mod v0.33.0
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading github.com/mitchellh/reflectwalk v1.0.2
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/miekg/dns v1.1.72
go: downloading github.com/sercand/kuberesolver/v5 v5.1.1
go: downloading github.com/golang-jwt/jwt/v5 v5.3.1
go: downloading github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f
go: downloading github.com/coreos/go-systemd/v22 v22.6.0
go: downloading github.com/mdlayher/vsock v1.2.1
go: downloading github.com/hashicorp/consul/api v1.32.1
go: downloading github.com/hashicorp/go-cleanhttp v0.5.2
go: downloading go.etcd.io/etcd/api/v3 v3.5.21
go: downloading go.etcd.io/etcd/client/pkg/v3 v3.5.21
go: downloading go.etcd.io/etcd/client/v3 v3.5.21
go: downloading github.com/hashicorp/go-immutable-radix v1.3.1
go: downloading github.com/hashicorp/go-msgpack/v2 v2.1.1
go: downloading github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529
go: downloading github.com/emicklei/go-restful/v3 v3.12.2
go: downloading github.com/jpillora/backoff v1.0.0
go: downloading github.com/mdlayher/socket v0.5.1
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading github.com/hashicorp/go-rootcerts v1.0.2
go: downloading github.com/hashicorp/serf v0.10.1
go: downloading github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7
go: downloading github.com/hashicorp/golang-lru v1.0.2
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/mitchellh/go-homedir v1.1.0
go: downloading github.com/coreos/go-semver v0.3.1
go: github.com/peak-scale/observability-tenancy/internal/handlers/processors/loki imports
	github.com/grafana/loki/v3/pkg/logproto imports
	github.com/grafana/loki/v3/pkg/storage/stores/shipper/indexshipper/tsdb/index imports
	github.com/prometheus/prometheus/tsdb/errors: cannot find module providing package github.com/prometheus/prometheus/tsdb/errors
go: github.com/peak-scale/observability-tenancy/internal/handlers/processors/loki imports
	github.com/grafana/loki/v3/pkg/logproto imports
	github.com/grafana/loki/v3/pkg/logql/syntax imports
	github.com/grafana/loki/v3/pkg/logql/log imports
	github.com/prometheus/prometheus/storage/remote/otlptranslator/prometheus: cannot find module providing package github.com/prometheus/prometheus/storage/remote/otlptranslator/prometheus

fix(deps): update module github.com/prometheus/prometheus to v0.311.2…

e00de0f

… [security]

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security]#101

fix(deps): update module github.com/prometheus/prometheus to v0.311.2 [security]#101
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-github.com-prometheus-prometheus-vulnerability

renovate Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Details

Impact

Patches

Workarounds

Acknowledgements

Severity

References

Release Notes

Configuration

Uh oh!

renovate Bot commented Apr 13, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 13, 2026 •

edited

Loading