Prometheus Web UI Stored Cross-Site Scripting

This repository is a small standalone proof-of-concept exploit for CVE-2026-40179, a stored XSS vulnerability in Prometheus 3.x. It contains only two files: a README with exploitation, cleanup, and testing guidance, and a single Python script that performs the exploit. The Python code manually encodes a Prometheus remote_write protobuf WriteRequest without generated protobuf bindings, compresses it with Snappy, and POSTs it with requests to the Prometheus remote_write endpoint at https://<target>:9090/api/v1/write. The injected time series uses the __name__ label to store an HTML/JavaScript payload in the metric name: an img tag with an onerror handler that executes JavaScript when the metric is rendered unsafely in the Prometheus web UI. The default payload is low-noise and only calls console.log, but the README explains how to swap it for alert(). The exploit capability is therefore persistent data injection leading to stored client-side code execution in the browser of a user viewing the affected metric. It is not a scanner or detector; it actively writes malicious series data to the target TSDB. The exploit requires a reachable vulnerable Prometheus instance, especially one exposing unauthenticated remote_write, and user interaction in a vulnerable UI surface to trigger execution. The README also documents cleanup endpoints under the optional admin API and notes that the artifact persists if admin cleanup is unavailable.