Lucene search

Veracode Vulnerability DatabaseVERACODE:39583

HistoryMar 08, 2023 - 3:07 a.m.

Cross-site Scripting (XSS)

2023-03-0803:07:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vega

vulnerability

javascript

browser

0.002 Low

EPSS

Percentile

54.2%

JSON

vega is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the scale expression function can call arbitrary functions with a single controlled argument, allowing an attacker to escape the vega expression sandbox and inject and execute malicious JavaScript into the browser.

CPENameOperatorVersion
vegale5.22.1
vega-functionsle5.13.0
vegale5.22.1
vegale5.22.1
vegale5.22.1
vega-functionsle5.13.0
vegale5.22.1
vegale5.22.1

Name	Operator	Version
vega	le	5.22.1
vega-functions	le	5.13.0
vega	le	5.22.1
vega	le	5.22.1
vega	le	5.22.1
vega-functions	le	5.13.0
vega	le	5.22.1
vega	le	5.22.1

References

github.com/advisories/GHSA-4vq7-882g-wcg4

github.com/vega/vega/commit/ab371a0093a8cb6215f7bdd5716f33aba6b6ee0f

github.com/vega/vega/releases/tag/v5.23.0

github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4

github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37

github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6

vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA

0.002 Low

EPSS

Percentile

54.2%

JSON

Related for VERACODE:39583