{"id":"CVE-2017-16009","aliases":["CLSA-2026-1780361414","CLSA-2026-1780361415","CLSA-2026-1780361416","CLSA-2026-1780361417","CLSA-2026-1781830548","CLSA-2026-1781830549","CLSA-2026-1781830550","EUVD-2020-1346","GHSA-wfw3-rgfr-6g67"],"status":"published","title":"XSS via Angular Expression in ag-grid","description":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01029,"percentile":0.63895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-06-04T19:00:00Z","modified":"2026-10-26T13:21:31Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"18.1.3-beta.1"}]}]},{"source":"osv","ecosystem":"npm","package":"ag-grid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"18.1.3-beta.1"}]}]}],"products":[{"vendor":"ag-grid","product":"ag-grid"},{"vendor":"hackerone","product":"ag-grid node module"}],"references":[{"url":"https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","web"]},{"url":"https://nodesecurity.io/advisories/327","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://github.com/ceolter/ag-grid/issues/1287","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16009","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wfw3-rgfr-6g67"},{"url":"https://github.com/ag-grid/ag-grid","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-16009","description":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T02:41:23.964Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2020-1346","description":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T02:41:23Z","updated_at":"2026-11-03T00:28:38.264635Z"}],"ghsa":[{"id":"GHSA-wfw3-rgfr-6g67","title":"XSS via Angular Expression in ag-grid","description":"Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.\n\n\n## Recommendation\n\nAvoid using `ag-grid` in combination with AngularJS until a fix is available.","status":"published","published":"2020-09-01T16:40:42Z","modified":"2023-03-24T21:26:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:48.905887Z"}],"nvd":[{"id":"CVE-2017-16009","description":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.","status":"published","published":"2018-06-04T19:29:00.727Z","modified":"2026-06-17T01:08:38.24Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16009","description":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.","status":"published","published":"2018-06-04T19:29:00.727Z","modified":"2026-10-20T10:48:51.203951095Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"GHSA-wfw3-rgfr-6g67","title":"XSS via Angular Expression in ag-grid","description":"Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.\n\n\n## Recommendation\n\nAvoid using `ag-grid` in combination with AngularJS until a fix is available.","status":"published","published":"2020-09-01T16:40:42Z","modified":"2023-11-08T03:58:59.526744Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"CLSA-2026-1780361414","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 16.0.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:34Z","modified":"2026-10-16T19:00:02.134635593Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780361415","title":"TuxCare security update for ag-grid (1 CVE)","description":"TuxCare rebuilt ag-grid to address 1 CVE. Fixed in 17.1.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:34Z","modified":"2026-10-16T19:00:03.07574114Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780361416","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 17.1.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:34Z","modified":"2026-10-16T19:00:03.087737804Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780361417","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 18.0.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:34Z","modified":"2026-10-16T19:00:02.139560218Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781830548","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 18.0.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:38Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830549","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 16.0.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:38Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830550","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 17.1.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:38Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:45.794021Z"}]}}