GitHub Advisoryadvisory · npm

GHSA-876p-c77m-x2hc Prototype pollution in ag-grid-community via the _.mergeDeep function

HIGH Published 2024-07-01 Modified 2024-09-04 Official page ↗
Aliases
CVE-2024-38996
Ecosystem
npm
Packages
ag-grid-enterprise, ag-grid-community
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2024-07-01

Affected packages

• npm ag-grid-enterprise: < 31.3.4 → fixed in 31.3.4 • npm ag-grid-community: < 31.3.4 → fixed in 31.3.4

Description

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Prior versions were also found to be affected.

Related

Alias · CVE (1)

  • CVE-2024-38996 ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References