Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-38996

27
FAUCET Score

CVE-2024-38996 is a critical prototype pollution vulnerability affecting ag-grid-community and ag-grid-enterprise versions 31.3.2. This flaw, stemming from the _.mergeDeep function, allows unauthenticated attackers to inject arbitrary properties, potentially leading to arbitrary code execution or Denial of Service. With a CVSS score of 9.8, it poses a severe risk due to its network-based attack vector and low complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 31.3.4CPE matchmatch criteria
cpe:2.3:a:ag-grid:ag-grid:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.16%
Probability of exploitation in next 30 days
EPSS Percentile
63.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0116 is in the 50th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

npmpatch availablevia ghsa
Product: ag-grid-enterpriseFixed in: 31.3.4
npmpatch availablevia ghsa
Product: ag-grid-communityFixed in: 31.3.4

Vendor Advisories (1)

npmGHSA-876p-c77m-x2hchigh

Prototype pollution in ag-grid-community via the _.mergeDeep function

Jul 1, 2024

References

gist.github.com / mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
ExploitThird Party Advisory
gist.github.com / mestrtee/c1590660750744f25e86ba1bf240844b
ExploitThird Party Advisory
gist.github.com / mestrtee/f8037d492dab0d77bca719e05d31c08b
ExploitThird Party Advisory