Executive brief
ag-grid is a widely-used data grid library for web applications. When used together with AngularJS, the library is vulnerable to Cross-Site Scripting (XSS) attacks, which could allow an attacker to inject malicious scripts and steal user data, hijack sessions, or deface pages. This vulnerability affects applications that combine ag-grid with AngularJS for rendering dynamic content.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in ag-grid that arises from improper handling of Angular expressions when the library is used in combination with AngularJS. The vulnerability allows attackers to inject malicious JavaScript through Angular expression syntax if the grid content is populated with unsanitized user input. The attack requires user interaction (e.g., viewing a malicious grid) but has a network attack vector. All versions of ag-grid up to and including 18.1.3-beta.1 are affected. The recommended mitigation is to avoid using ag-grid with AngularJS until patches are available, or to properly sanitize all user-controlled input before passing it to the grid.
Affected products
- ag-Grid ag-grid up to 18.1.3-beta.1
Timeline
- 2020-09-01: disclosed: Advisory published in GitHub Security Advisory database
- 2018-06-04: advisory: CVE-2017-16009 published in NVD