CVE-2020-26296

CVE-2020-26296 concerns a cross-site scripting (XSS) vulnerability in the Vega visualization library used in the npm package, present in Vega before version 5.17.3. The vulnerability arises from specially crafted Vega expressions that could cause arbitrary JavaScript execution on a victim’s machi...

@foretold/components (>=0.0.4, <=0.0.6), @qzchenwl/jupyterlab_voyager (>=0.1.0, <=0.1.6) +11 more potentially affected by CVE-2020-26296 via vega (>=5.0.0, <=5.17.2)

vega NPM version =5.0.0, =0.0.4, =0.1.0, =0.11.4, =1.0.3-alpha.5, =0.0.2, =0.0.5, =2.4.0, =1.0.0, =0.9.0, =1.0.0, =5.0.0-rc1, =5.17.2 Source cves: CVE-2020-26296 Source advisory: OSV:GHSA-R2QC-W64X-6J54...

CVE-2026-26296

...