Опубликовано: 01 июл. 2024
Источник: github
Github: Прошло ревью
CVSS4: 8.9
CVSS3: 9.8
Описание
Prototype pollution in ag-grid-community via the _.mergeDeep function
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Prior versions were also found to be affected.
Пакеты
Наименование
ag-grid-enterprise
npm
Затронутые версииВерсия исправления
< 31.3.4
31.3.4
Наименование
ag-grid-community
npm
Затронутые версииВерсия исправления
< 31.3.4
31.3.4
Связанные уязвимости
CVSS3: 9.8
nvd
больше 1 года назад
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.