CVE-2023-26486: Vega `scale` expression function cross site scripting
First published: Fri Mar 03 2023(Updated: )
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm is-function | <5.13.1 | |
| Vega Project Vega | <5.23.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vega/vega/releases/tag/v5.23.0
- https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6
- https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA
Frequently Asked Questions
What is CVE-2023-26486?
CVE-2023-26486 is a vulnerability in the Vega visualization grammar that allows arbitrary function calls with a user-supplied argument.
How does CVE-2023-26486 affect Vega?
CVE-2023-26486 affects Vega by exploiting the scale expression function, allowing attackers to call arbitrary functions with a controlled argument.
What is the severity of CVE-2023-26486?
CVE-2023-26486 has a severity rating of medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2023-26486?
Vega-functions v5.13.1 and Vega v5.23.0 (up to exclusive) are affected by CVE-2023-26486.
How can I fix CVE-2023-26486?
To fix CVE-2023-26486, update your Vega or Vega-functions software to a version higher than the affected versions.
- agent/type
- agent/weakness
- agent/title
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/softwarecombine
- agent/tags
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vega-functions project
- canonical/npm is-function
- vendor/vega project
- canonical/vega project vega