CVE-2023-26486

Katalog CVE

CVSS 6.1 · Medium EPSS 0,78%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada vega-functions project vega-functions, vega project vega. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.

Rincian

Terbit di NVD

4 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4 exploit · advisory pihak ketiga
• https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQB... exploit
• https://github.com/vega/vega/releases/tag/v5.23.0 release notes
• https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functio... permissions required
• https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.... permissions required