Vega vulnerable to arbitrary code execution when clicking href links

Description

Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.

Recommendation

Update the vega package to the latest compatible version. Followings are version details:

• Affected version(s): **< 4.5.1

  >= 5.0.0, < 5.4.1**

• Patched version(s): **4.5.1

  5.4.1**

References

• GHSA-cp47-r258-q626

Related Issues

• Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133
• React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
• Arbitrary Code Execution in require-node - Vulnerability
• @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability

Tags:

npm

vega