🛡️ CVE-2019-3826 — prometheus

⚪ Unknown ✅ No Known Exploit CWE-79 OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Withdrawn Advisory: Prometheus XSS Vulnerability

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.

Original Description

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality low, integrity low, availability none.

Weakness class

CVE-2019-3826 is classified as CWE-79: Cross-site Scripting (XSS). User-supplied data is written into a page without escaping, so attacker script runs in the browser of anyone who views it.

Affected software

CVE-2019-3826 is recorded against 1 package.

github.com/prometheus/prometheus

Timeline and source

Published on 13 December 2023 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Web)
access.redhat.com (Web)
advisory.checkmarx.net (Web)
bugzilla.redhat.com (Web)
gitlab.com (Web)
lists.apache.org (Web)
lists.apache.org (Web)
lists.apache.org (Web)

Details

Severity Unknown

CVSS Score N/A

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE CWE-79

Public Exploit ✅ No

Source OSV

Published 2023-12-13

Updated 2026-08-12

Modified 2026-02-04

Fix URL N/A

Affected Packages

Software	From version	Fixed in
github.com/prometheus/prometheus	—	—

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-3826

WEB https://github.com/aquasecurity/trivy/issues/2992

WEB https://github.com/prometheus/prometheus/pull/5163

WEB https://github.com/prometheus/prometheus/pull/5163/commits/ea254eea5e3c9a12d6f37a25921b7259ff1c4280

WEB https://github.com/prometheus/prometheus/commit/62e591f9

WEB https://access.redhat.com/errata/RHBA-2019:0327

WEB https://advisory.checkmarx.net/advisory/CX-2019-4297

WEB https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826

WEB https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/merge_requests/26608

WEB https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E

WEB https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E

WEB https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E

🔗 NVD 🔗 Mitre

Similar Threats

Medium ROOT-APP-GOBINARY-CVE-2026-40179
High ROOT-APP-GOBINARY-CVE-2026-42151
High ROOT-APP-GOBINARY-CVE-2026-42154
Medium ROOT-APP-GOBINARY-CVE-2026-44903
Medium ROOT-APP-GOBINARY-GHSA-fw8g-cg8f-9j28

More CVE 2019 advisories

Browse all of CVE 2019 in the advisory index.

Free Vulnerability Check

Is your site affected by CVE-2019-3826?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2019-3826 and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.