XSS via Angular Expression in ag-grid

中危 6.1CVE-2017-16009 · GHSA-wfw3-rgfr-6g67 · Published 04/06/2018 · updated 17/06/2026

要点

CVE-2017-16009 是影响 ag-grid (ag-grid), ag-grid 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.0%，高于 63.8% 的漏洞。
修复：升级到 27.0.0 或更高版本。

Package	Affected versions	Patched versions
ag-grid ag-grid	`< 27.0.0`	`27.0.0`
ag-grid npm	`≤ 18.1.3-beta.1`	No fix yet

Description

Affected versions of ag-grid are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.

Recommendation

Avoid using ag-grid in combination with AngularJS until a fix is available.

NVD description

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

References

nvd.nist.gov/vuln/detail/CVE-2017-16009 · ADVISORY
ceolter/ag-grid · WEB
ag-grid/ag-grid · PACKAGE
spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss · WEB
nodesecurity.io/advisories/327 · Broken Link

ag-grid 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ag-grid

< 27.0.0

27.0.0

ag-grid

npm

≤ 18.1.3-beta.1

No fix yet

Description

Affected versions of ag-grid are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.

Recommendation

Avoid using ag-grid in combination with AngularJS until a fix is available.

NVD description

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

ag-grid 的其他漏洞

查看全部 →