Vega allows Cross-site Scripting via the vlSelectionTuples function (GHSA-mp7w-mhcv-673j)
- Severity:
- Medium
Description
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
Recommendation
Update the vega-selections package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.4.2
- Patched version(s): 5.4.2
References
Related Issues
- webpack-dev-server users' source code may be stolen when they access a malicious web site - CVE-2025-30359
- Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service - CVE-2022-35204
- Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) 2 - CVE-2023-50728
- method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header - CVE-2017-16136
- Tags:
- npm
- vega-selections
Anything's wrong? Let us know Last updated on February 14, 2025