Executive brief
ag-grid-community is a popular open-source data grid component library used in web applications. A prototype pollution vulnerability in its mergeDeep function allows attackers to inject arbitrary properties into JavaScript objects, potentially leading to remote code execution or application crashes. This affects applications that depend on vulnerable versions of the library.
Technical details
The vulnerability is a prototype pollution issue (CWE-1321) in the _.mergeDeep function of ag-grid-community and ag-grid-enterprise versions prior to 31.3.4. An attacker can craft malicious input that, when merged via the vulnerable function, pollutes the Object prototype with arbitrary properties. This requires no authentication or user interaction and is exploitable over the network through any code path that processes untrusted data with mergeDeep. Successful exploitation can result in arbitrary code execution or denial of service. The fix was released in version 31.3.4 (merged July 9, 2024).
Affected products
- ag-grid ag-grid-community prior to 31.3.4
- ag-grid ag-grid-enterprise prior to 31.3.4
Timeline
- 2024-07-01: disclosed: Vulnerability published in advisory database
- 2024-07-09: patched: Fix merged into version 31.3.4