ag-grid Cross-Site Scripting vulnerability

published 2020-09-02 6y ago modified 2025-07-10 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Versions of `ag-grid` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid.

## Recommendation

Upgrade to version 14.0.0 or later.

Patch / fix

fixed in 1 links 1

npm ag-grid 14.0.0

github.com/ag-grid/ag-grid@b66b1dd commit

Is GHSA-7p6w-x2gr-rrf8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	ag-grid	<14.0.0	14.0.0

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-7p6w-x2gr-rrf8

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.