Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. 1. Use vega in an application that attaches vega library and a vega.View instance similar to the Vega Editor to the global window 2. Allow user-defined Vega JSON definitions (vs JSON that was is only provided through source code) Patches - If using latest Vega line (6.x) - vega 6.2.0 / vega-expression 6.1.0 / vega-interpreter 2.2.1 (if using AST evaluator mode) - If using Vega in a non-ESM environment - ( vega-expression 5.2.1 / 1.2.1 (if using AST evaluator mode) Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading - Do not attach vega View instances to global variables, as Vega editor used to do here - Do not attach vega to the global window as the editor used to do here These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in…
Recommended action: Upgrade to 6.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter. Workarounds - Use vega with expression interpreter - Upgrade to a newer Vega version (5.32.0) POC Summary Calling replace with a RegExp-like pattern calls RegExp.prototype[@@replace], which can then call an attacker-controlled exec function. POC Details Consider the function call replace('foo', {proto: /h/.constructor.prototype, global: false}). Since pattern has RegExp.prototype[@@replace], pattern.exec('foo') winds up being called. The resulting malicious call looks like this: Since functions cannot be returned from this, an attacker that wishes to escalate to XSS must abuse event.view to gain access to eval. Reproduction steps
Recommended action: Upgrade to 5.32.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. Patches Patched in vega 5.31.0 / vega-functions 5.16.0 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? - Run vega without vega.expressionInterpreter. This mode is not the default as it is slower. - Using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability. References - Reported to Vega-Lite by @kprevas Nov 8 2024 in https://github.com/vega/vega-lite/issues/9469 & https://github.com/vega/vega/issues/3984 Reproduction of the error in Vega by @mattijn
Recommended action: Upgrade to 5.31.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS. Details vlSelectionTuples calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. Example call: vlSelectionTuples([{datum:<argument}], {fields:[{getter:<function}]}) This can be used to call Function() with arbitrary JavaScript and the resulting function can be called with vlSelectionTuples or using a type coercion to call toString or valueOf. PoC
Recommended action: Upgrade to 5.26.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.
Recommended action: Upgrade to 5.4.1 or 4.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. Details The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. PoC The following Vega definition can be used to demonstrate this issue executing the JavaScript code alert(1); This can be viewed in the Vega online IDE at…
Recommended action: Upgrade to 5.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vega's lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as push call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a push function as the 1st argument, push function can be set to any function that can be access via event.view (no all such functions can be exploited due to invalid context or signature, but some can, e.g. console.log). Details The issue is that lassoAppend doesn't enforce proper types of its arguments: PoC Use the following Vega snippet (depends on browser's non-built-in event.view.setImmediate function, feel free to replace with event.view.console.log or alike and observe the result in the browser's console) Impact This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS setImmediate polyfill basically…
Recommended action: Upgrade to 5.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3
Recommended action: Upgrade to 5.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.