CVE-2023-26487: Vega has cross-site scripting vulnerability in `lassoAppend` function

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-04 · updated 2026-06-17
Weakness: CWE-79

Description

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.

Affected products

Vega-Functions Project Vega-Functions: before 5.13.1 — fixed in 5.13.1
vega: before 5.23.0 — fixed in 5.23.0

How to fix

Upgrade to a fixed version: Vega-Functions Project Vega-Functions 5.13.1; vega 5.23.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26487 or the next vulnerability affects your stack