CVE-2024-38996: ag-grid-community were discovered to contain a prototype pollution via the _.mergeDeep function

July 1, 2024 (updated June 10, 2026)

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

References

gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
github.com/advisories/GHSA-876p-c77m-x2hc
github.com/ag-grid/ag-grid
nvd.nist.gov/vuln/detail/CVE-2024-38996

Code Behaviors & Features

Detect and mitigate CVE-2024-38996 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →