Detections
Analytics

SCA: security update for @grafana/data (GHSA-3j9m-hcv9-rpj8)

medium Tenable Cloud Security Plugin ID 409569

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker
 is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content
 may be executed within the context of the victim's browser. The user visiting the malicious link must be
 unauthenticated and the link must be for a page that contains the login button in the menu bar. The url
 has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS
 expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex:
 {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login
 button will contain the original link with a query parameter to force a redirect to the login page. The
 URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained
 in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you
 can use a reverse proxy or similar to block access to block the literal string {{ in the path.
 (CVE-2021-41174)

See Also

https://github.com/advisories/GHSA-3j9m-hcv9-rpj8

Plugin Details

Severity: Medium

ID: 409569

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-41174

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/8/2021

Vulnerability Publication Date: 11/3/2021

Reference Information

CVE: CVE-2021-41174

cwe: CWE-79