{"id":"CVE-2024-38996","aliases":["CLSA-2026-1780274969","CLSA-2026-1780274970","CLSA-2026-1780274971","CLSA-2026-1780447828","CLSA-2026-1780447829","CLSA-2026-1780447846","CLSA-2026-1780534254","CLSA-2026-1780534255","CLSA-2026-1780534256","CLSA-2026-1780534257","CLSA-2026-1780534258","CLSA-2026-1780620668","CLSA-2026-1780620671","CLSA-2026-1780620682","CLSA-2026-1784856319","EUVD-2024-2292","GHSA-876p-c77m-x2hc"],"status":"published","title":"Prototype pollution in ag-grid-community via the _.mergeDeep function","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01158,"percentile":0.67493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2024-07-01T00:00:00Z","modified":"2026-11-02T19:46:34Z","fixes":[{"ecosystem":"npm","package":"ag-grid-enterprise","fixed_in":["31.3.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"ag-grid-community","fixed_in":["31.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.3.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.3.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-polymer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0-tuxcare.0"},{"fixed":"25.0.0-tuxcare.1"}]}],"versions":["25.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-polymer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.2-tuxcare.0"},{"fixed":"23.0.2-tuxcare.1"}]}],"versions":["23.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-polymer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.2.1-tuxcare.0"},{"fixed":"23.2.1-tuxcare.1"}]}],"versions":["23.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.2.0-tuxcare.0"},{"fixed":"20.2.0-tuxcare.1"}]}],"versions":["20.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.2.0-tuxcare.0"},{"fixed":"20.2.0-tuxcare.1"}]}],"versions":["20.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0-tuxcare.0"},{"fixed":"21.0.0-tuxcare.1"}]}],"versions":["21.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0-tuxcare.0"},{"fixed":"21.0.0-tuxcare.1"}]}],"versions":["21.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-polymer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.1.0-tuxcare.0"},{"fixed":"26.1.0-tuxcare.1"}]}],"versions":["26.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-polymer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.2.1-tuxcare.0"},{"fixed":"26.2.1-tuxcare.1"}]}],"versions":["26.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.1.0-tuxcare.0"},{"fixed":"29.1.0-tuxcare.1"}]}],"versions":["29.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.0-tuxcare.0"},{"fixed":"28.2.0-tuxcare.1"}]}],"versions":["28.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.1-tuxcare.0"},{"fixed":"28.1.1-tuxcare.1"}]}],"versions":["28.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.1-tuxcare.0"},{"fixed":"28.1.1-tuxcare.1"}]}],"versions":["28.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-angular-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1.0-tuxcare.0"},{"fixed":"28.1.0-tuxcare.1"}]}],"versions":["28.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-solid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.1.0-tuxcare.0"},{"fixed":"30.1.0-tuxcare.1"}]}],"versions":["30.1.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.2.0-tuxcare.0"},{"fixed":"30.2.0-tuxcare.1"}]}],"versions":["30.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-charts-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-solid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-vue3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.1.1-tuxcare.0"},{"fixed":"31.1.1-tuxcare.1"}]}],"versions":["31.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.0.0-tuxcare.0"},{"fixed":"26.0.0-tuxcare.1"}]}],"versions":["26.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ag-grid-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.0.0-tuxcare.0"},{"fixed":"26.0.0-tuxcare.1"}]}],"versions":["26.0.0"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"ag-grid-enterprise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"31.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"ag-grid-community","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"31.3.4"}]}]}],"products":[{"vendor":"ag-grid","product":"ag-grid"},{"vendor":"ag-grid","product":"ag-grid-enterprise"}],"references":[{"url":"https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38996","tags":["advisory"]},{"url":"https://github.com/ag-grid/ag-grid/pull/8290","tags":["web"]},{"url":"https://github.com/advisories/GHSA-876p-c77m-x2hc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38996.json","tags":["advisory"]},{"url":"https://github.com/ag-grid/ag-grid","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-38996","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2024-08-02T04:19:20.621Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-2292","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2024-08-02T04:19:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"ghsa":[{"id":"GHSA-876p-c77m-x2hc","title":"Prototype pollution in ag-grid-community via the _.mergeDeep function","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Prior versions were also found to be affected.","status":"published","published":"2024-07-01T15:32:17Z","modified":"2024-09-04T16:39:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:00.257632Z"}],"nvd":[{"id":"CVE-2024-38996","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T13:15:05.103Z","modified":"2026-06-17T07:41:20.137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-38996","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2026-10-28T02:30:28.434848169Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-876p-c77m-x2hc","title":"Prototype pollution in ag-grid-community via the _.mergeDeep function","description":"ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Prior versions were also found to be affected.","status":"published","published":"2024-07-01T15:32:17Z","modified":"2026-09-10T03:50:16.345864545Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"CLSA-2026-1780274969","title":"TuxCare security update for 7 packages (2 CVEs)","description":"TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 25.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.323970448Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780274970","title":"TuxCare security update for 6 packages (2 CVEs)","description":"TuxCare rebuilt 6 packages to address 2 CVEs. Fixed in 23.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.662647813Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780274971","title":"TuxCare security update for 6 packages (2 CVEs)","description":"TuxCare rebuilt 6 packages to address 2 CVEs. Fixed in 23.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.70079059Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780447828","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 20.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:46:33.782484925Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1780447829","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 21.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:46:33.900683145Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1780447846","title":"TuxCare security update for 7 packages (2 CVEs)","description":"TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 26.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.707443721Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780534254","title":"TuxCare security update for 7 packages (2 CVEs)","description":"TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 26.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.729122229Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780534255","title":"TuxCare security update for ag-grid-community (2 CVEs)","description":"TuxCare rebuilt ag-grid-community to address 2 CVEs. Fixed in 29.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-20T13:45:06.961257624Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780534256","title":"TuxCare security update for ag-grid-community (2 CVEs)","description":"TuxCare rebuilt ag-grid-community to address 2 CVEs. Fixed in 28.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-20T13:45:05.05045492Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780534257","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 28.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:46:33.931998056Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1780534258","title":"TuxCare security update for 8 packages (2 CVEs)","description":"TuxCare rebuilt 8 packages to address 2 CVEs. Fixed in 28.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.544280167Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780620668","title":"TuxCare security update for 8 packages (2 CVEs)","description":"TuxCare rebuilt 8 packages to address 2 CVEs. Fixed in 30.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.525622368Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780620671","title":"TuxCare security update for ag-grid-community (2 CVEs)","description":"TuxCare rebuilt ag-grid-community to address 2 CVEs. Fixed in 30.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-20T13:45:05.852404411Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780620682","title":"TuxCare security update for 9 packages (2 CVEs)","description":"TuxCare rebuilt 9 packages to address 2 CVEs. Fixed in 31.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.791237856Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1784856319","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 26.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-11-02T19:46:34.294737747Z","updated_at":"2026-11-02T20:28:42.34712Z"}]}}