Vega Expression Language `scale` expression function Cross Site Scripting

Description

The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript.

Recommendation

Update the vega-functions package to the latest compatible version. Followings are version details:

Affected version(s): < 5.13.1
Patched version(s): 5.13.1

References

GHSA-4vq7-882g-wcg4
github.dev
vega.github.io
CVE-2023-26486
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Vega Expression Language `scale` expression function Cross Site Scripting and gives you actionable findings to investigate.

Start a free scan

Related Issues

Vega Expression Language `scale` expression function Cross Site Scripting - vega - CVE-2023-26486
Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487
Vega has Cross-site Scripting vulnerability in `lassoAppend` function - vega - CVE-2023-26487
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated March 09, 2023