medium6.1
CVE-2017-16009
XSS via Angular Expression in ag-grid
Impact
Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS. ## Recommendation Avoid using `ag-grid` in combination with AngularJS until a fix is available.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ag-grid | <= 18.1.3-beta.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ag-Grid | Ag-Grid | before 27.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ceolter/ag-grid/issues/1287
- https://nodesecurity.io/advisories/327
- https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss
- https://github.com/advisories/GHSA-wfw3-rgfr-6g67
- https://nvd.nist.gov/vuln/detail/CVE-2017-16009