CVE-2017-16009

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

Score

CVSS 3.1 6.1 Medium

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Ag-grid (Ag-grid)
• Ag-grid Node Module (Hackerone)

References

• https://github.com/ceolter/ag-grid/issues/1287
• https://nodesecurity.io/advisories/327
• https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss