Vulnerability · Published Mar 3, 2023 · Assigned by GitHub_M
CVE-2023-26486Vega `scale` expression function cross site scripting
Medium 6.5
In plain English
A medium-severity cross-site scripting in vega from vega. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | vega.js | no fix listed | DEBIAN-CVE-2023-26486 |
| Debian:13 | vega.js | 5.25.0+ds+~cs5.3.0-1 | DEBIAN-CVE-2023-26486 |
| Debian:14 | vega.js | 5.25.0+ds+~cs5.3.0-1 | DEBIAN-CVE-2023-26486 |
| npm | vega | 5.23.0 | GHSA-4vq7-882g-wcg4 |
| npm | vega-functions | 5.13.1 | GHSA-4vq7-882g-wcg4 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4 x_refsource_CONFIRM
- https://github.com/vega/vega/releases/tag/v5.23.0 x_refsource_MISC
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37 x_refsource_MISC
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6 x_refsource_MISC
- https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA x_refsource_MISC