CVE-2017-16009: XSS via Angular Expression in ag-grid
Summary
CVE-2017-16009: XSS via Angular Expression in ag-grid. Affects ag-grid versions < 18.1.3-beta.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ag-grid is an open-source JavaScript library for building data grids. It provides a rich set of features and functionalities for displaying and manipulating tabular data. However, versions of ag-grid prior to 18.1.3-beta.1 are vulnerable to Cross-site Scripting (XSS) attacks when used in combination with AngularJS.
Vulnerability Detail
The vulnerability in ag-grid allows for Cross-site Scripting (XSS) attacks through Angular Expressions. If an attacker can inject malicious code into an Angular Expression used in ag-grid, it can be executed in the context of the application, potentially leading to unauthorized access, data theft, or other malicious activities. This vulnerability affects versions of ag-grid prior to 18.1.3-beta.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best approach is to follow the recommended fix and avoid using ag-grid with AngularJS until a fix is available.
Conclusion
ag-grid versions prior to 18.1.3-beta.1 are vulnerable to Cross-site Scripting (XSS) attacks when used with AngularJS. It is recommended to avoid using ag-grid with AngularJS until a fix is available. Keeping the ag-grid library updated to the latest version is important to ensure any security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ag-grid →
FAQ
ag-grid is an open-source JavaScript library for building data grids. It provides a rich set of features and functionalities for displaying and manipulating tabular data.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.
The vulnerability in ag-grid allows for Cross-site Scripting (XSS) attacks through Angular Expressions. If an attacker can inject malicious code into an Angular Expression used in ag-grid, it can be executed in the context of the application, potentially leading to unauthorized access, data theft, or other malicious activities.
Versions of ag-grid prior to 18.1.3-beta.1 are affected by this vulnerability.
At the time of this report, there is no fix available for this vulnerability. It is recommended to avoid using ag-grid in combination with AngularJS until a fix is released.
Related vulnerabilities
Recent vulnerabilities recorded for ag-grid.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
