Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util

Description

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

Recommendation

Update the vega-util package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.1
• Patched version(s): 1.13.1

References

• GHSA-6hwh-rqwf-cxxr
• snyk.io
• CVE-2019-10806
• CWE-1321
• CWE-20
• CWE-915
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message - CVE-2025-64758
• `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` - CVE-2025-62381
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Modified package published to npm, containing malware that exfiltrates private key material - CVE-2024-54134

Tags:

npm

vega-util