ag-grid vulnerabilities

Products

• ag-grid 3
• ag-grid-enterprise 2
• ag charts 1
• ag-grid-community 1

Latest ag-grid CVEs

Newest publication first

1. CVE-2024-38996 Prototype pollution in ag-grid-community via the _.mergeDeep function

   Published 2024-07-01

   Critical·CVSS 9.8 EPSS 1.2%

   ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

2. CVE-2024-39001 ag-grid packages vulnerable to Prototype Pollution

   Published 2024-07-01

   Medium·CVSS 6.3 EPSS 0.83%

   ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

3. CVE-2017-16009 XSS via Angular Expression in ag-grid

   Published 2018-06-04

   Medium·CVSS 6.1 EPSS 1.0%

   ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.