{"action":"Upgrade github.com/grafana/alloy to 1.3.4 or later.","affected":[{"fixed":"1.3.4","introduced":"0"},{"fixed":"1.4.1","introduced":"1.4.0-rc.0"}],"component":"github.com/grafana/alloy","cve_ids":["CVE-2024-8975"],"ecosystem":"Go","epss":0.003,"exploited":false,"fixed_versions":["1.3.4","1.4.1"],"ghsa_id":"GHSA-chqx-36rm-rf8h","id":"tcs_01M5KF7CBQGD11727TRQMFNNYM","modified_at":"2025-05-21T09:42:04.026423Z","published_at":"2024-09-25T18:31:21Z","references":["https://osv.dev/vulnerability/GHSA-chqx-36rm-rf8h","https://nvd.nist.gov/vuln/detail/CVE-2024-8975","https://github.com/grafana/alloy/commit/88e779887690954c009503598a3f4bf563cb6596","https://github.com/grafana/alloy/commit/f14249012fd970d3fd73604e6fff9b6c7990a9bb","https://github.com/grafana/alloy","https://github.com/grafana/alloy/releases/tag/v1.3.4","https://github.com/grafana/alloy/releases/tag/v1.4.0","https://github.com/grafana/alloy/releases/tag/v1.4.1","https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996","https://grafana.com/security/security-advisories/cve-2024-8975","https://pkg.go.dev/vuln/GO-2024-3168"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-chqx-36rm-rf8h","url":"https://osv.dev/vulnerability/GHSA-chqx-36rm-rf8h"}],"summary":"Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability"}