Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability

HOCH 7.8CVE-2024-8975 · BIT-grafana-alloy-2024-8975 · GHSA-chqx-36rm-rf8h · Published 25/09/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-8975 ist eine Schwachstelle (HOCH (CVSS 7.8)) in github.com/grafana/alloy, alloy (grafana).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.30%, höher als bei 22.8% aller Schwachstellen.
Abhilfe: auf 1.4.1, 1.3.4, 1.3.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/grafana/alloy Go	`≥ 1.4.0-rc.0, < 1.4.1< 1.3.4`	`1.4.11.3.4`
alloy grafana	`= 1.4.0< 1.3.3`	`1.3.3`

Description

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM. This issue affects Alloy: before 1.3.4, from 1.4.0-rc.0 and prior to 1.4.1.

NVD description

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free