GHSA-7p6w-x2gr-rrf8 ag-grid Cross-Site Scripting vulnerability
Attackers can execute arbitrary JavaScript in ag-grid by injecting unsanitized user input into grid contents, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-7p6w-x2gr-rrf8?
GHSA-7p6w-x2gr-rrf8 is a cross-site scripting vulnerability in ag-grid, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of ag-grid prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid.
Recommendation
Upgrade to version 14.0.0 or later.
Which versions are affected by GHSA-7p6w-x2gr-rrf8?
2 open source packages ship an affected version, including ag-grid.
| Package | Affected | Fixed in |
|---|---|---|
ag-grid npm | All versions | 14.0.0 |
ag-grid npm | All versions | 14.0.0 |
How do I fix GHSA-7p6w-x2gr-rrf8?
Upgrade ag-grid to 14.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-7p6w-x2gr-rrf8 being exploited?
There is no known exploitation of GHSA-7p6w-x2gr-rrf8 in the wild and no public exploit code.