CVE-2023-26486
Description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
How to fix
- vega_project vega5.23.0 or later
- vega-functions_project vega-functions5.13.1 or later
- vega-functions5.13.1 or later
- vega5.23.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vega_project vega | v < 5.23.0 | 5.23.0 |
| vega-functions_project vega-functions | v < 5.13.1 | 5.13.1 |
| vega-functionsnpm | v < 5.13.1 | 5.13.1 |
| veganpm | v < 5.23.0 | 5.23.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.