CVE-2017-16009

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-04 · updated 2026-06-17
Weakness: CWE-79

Description

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

Affected products

HackerOne ag-grid node module: before 27.0.0 — fixed in 27.0.0

How to fix

Upgrade to a fixed version: HackerOne ag-grid node module 27.0.0. Check the vendor advisory for mitigations.

References

https://github.com/ceolter/ag-grid/issues/1287
https://nodesecurity.io/advisories/327
https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss
https://github.com/ceolter/ag-grid/issues/1287
https://nodesecurity.io/advisories/327
https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss

Get alerted when CVE-2017-16009 or the next vulnerability affects your stack