Vega vulnerable to arbitrary code execution when clicking href links

Description

Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.

Recommendation

Update the vega package to the latest compatible version. Followings are version details:

• Affected version(s): **< 4.5.1

  >= 5.0.0, < 5.4.1**

• Patched version(s): **4.5.1

  5.4.1**

References

• GHSA-cp47-r258-q626

Related Issues

• Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133
• Sandbox Bypass Leading to Arbitrary Code Execution in constantinople - Vulnerability
• Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138
• Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-876r-hj45-fw7g - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

vega