CVE-2023-26487: Vega has cross-site scripting vulnerability in `lassoAppend` function
First published: Fri Mar 03 2023(Updated: )
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm is-function | <5.13.1 | |
| Vega Project Vega | <5.23.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-26487?
CVE-2023-26487 is a vulnerability in Vega, a visualization grammar, that allows attackers to execute arbitrary code.
How severe is CVE-2023-26487?
CVE-2023-26487 has a severity rating of 6.1 (Medium).
What software versions are affected by CVE-2023-26487?
CVE-2023-26487 affects Vega-functions versions up to and excluding 5.13.1 and Vega versions up to and excluding 5.23.0.
How do I fix CVE-2023-26487?
To fix CVE-2023-26487, upgrade to Vega-functions version 5.13.1 or higher and Vega version 5.23.0 or higher.
Where can I find more information about CVE-2023-26487?
You can find more information about CVE-2023-26487 on the GitHub links provided: [GitHub Commit](https://github.com/vega/vega/commit/01adb034f24727d3bb321bbbb6696a7f4cd91689), [GitHub Release](https://github.com/vega/vega/releases/tag/v5.23.0), [GitHub Security Advisory](https://github.com/vega/vega/security/advisories/GHSA-w5m3-xh75-mp55).
- agent/type
- agent/title
- agent/severity
- agent/references
- agent/weakness
- agent/remedy
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vega-functions project
- canonical/npm is-function
- vendor/vega project
- canonical/vega project vega