[data grid] CVE-2026-41907 uuid package in @mui/x-internal-exceljs-fork

[jst-schraml]

Hey there.

We are tracking CVEs for our projects and data grid premium is causing warnings because of GHSA-w5hq-g745-h8pq.
The @mui/x-data-grid-premium@8 package depends on @mui/x-internal-exceljs-fork@4 which depends on uuid@8.
Now the CVE specifically states that uuid v4 is not affected and from this exceljs issue text i would assume that your internal fork also only uses uuid v4.
So this CVE is probably not that relevant to you. Would just like to get rid of the CVE in our tracker.
Would it be possible for you to upgrade your uuid dependency to package version 14?

Thanks

[mj12albert]

This sounds easy to do as long as we're still releasing v8? @michelengelen

[jst-schraml]

not sure if this got changed, but GHSA-w5hq-g745-h8pq does not list uuid@8 as affected. so closing this

[github-actions]

This issue has been closed. If you have a similar problem but not exactly the same, please open a new issue.
Now, if you have additional information related to this issue or things that could help future readers, feel free to leave a comment.

---

@jst-schraml Thanks again for creating this issue! If you have a moment, we would love to hear your thoughts on how we handled it with this short feedback form.

[oliviertassinari]

not sure if this got changed, but GHSA-w5hq-g745-h8pq does not list uuid@8 as affected. so closing this

@jst-schraml It looks like you are correct; there is no issue for the MUI X Data Grid project. There was a mistake in the initial report about the version impacted. uuidjs/uuid#951 confirms that. So GHSA-w5hq-g745-h8pq is correct:

---

The other links are currently showing wrong information:

• GHSA-w5hq-g745-h8pq

• https://www.cve.org/CVERecord?id=CVE-2026-41907

---

(@mj12albert I polished this issue as we got other reports from users, e.g. https://groups.google.com/a/mui.com/g/security/c/LZgaD9LCbMk)

[IgorAufricht]

Hi, please let me know if I missed something, but the advisory is currently showing anything below version 11 is affected:

The first screenshot in the post above seems to not be aligned with the current state of the advisory.
See GHSA-w5hq-g745-h8pq

The uuid v8.3.2 shipped with mui-x@8 is still being reported as vulnerable by our DependencyTrack.

As a side note, uuid@8.3.2 is now marked as deprecated (see uuidjs/uuid#939 (comment)), so it would make sense to upgrade to a newer version.

[shahmir-oscilar]

@jst-schraml Please re-open this; as IgorAufricht indicated, the advisory does include v8 now