Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability

HIGH 7.8CVE-2024-8975 · BIT-grafana-alloy-2024-8975 · GHSA-chqx-36rm-rf8h · Published 25/09/2024 · updated 17/06/2026

In short

CVE-2024-8975 is a HIGH (CVSS 7.8) vulnerability affecting github.com/grafana/alloy, alloy (grafana).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.8% of all vulnerabilities.
Fix: update to 1.4.1, 1.3.4, 1.3.3 or later.

Package	Affected versions	Patched versions
github.com/grafana/alloy Go	`≥ 1.4.0-rc.0, < 1.4.1< 1.3.4`	`1.4.11.3.4`
alloy grafana	`= 1.4.0< 1.3.3`	`1.3.3`

Description

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM. This issue affects Alloy: before 1.3.4, from 1.4.0-rc.0 and prior to 1.4.1.

NVD description

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free