Vega `scale` expression function cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vega | vega | before 5.13.1 | 5.13.1 | Patch available | CNA |
| — | vega-functions (npm) | before 5.13.1 | 5.13.1 | Patch available | GHSA-4vq7-882g-wcg4 |
| — | vega (npm) | before 5.23.0 | 5.23.0 | Patch available | GHSA-4vq7-882g-wcg4 |
- vega Vendorvega Affected before 5.13.1 Fixed in 5.13.1 Patch available CNA
- vega-functions (npm) Vendor— Affected before 5.13.1 Fixed in 5.13.1 Patch available GHSA-4vq7-882g-wcg4
- vega (npm) Vendor— Affected before 5.23.0 Fixed in 5.23.0 Patch available GHSA-4vq7-882g-wcg4
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:* | before 5.13.1 | Vulnerable | Vega-functions Project |
| cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:* | before 5.23.0 | Vulnerable | Vega Project |
- cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:* Versions before 5.13.1 Vulnerable ·Vega-functions Project
- cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:* Versions before 5.23.0 Vulnerable ·Vega Project
Remediation
- Fix · CNA vega (vega) Fixed in 5.13.1
- Fix · GHSA-4vq7-882g-wcg4 vega-functions (npm) Fixed in 5.13.1 Advisory →
- Fix · GHSA-4vq7-882g-wcg4 vega (npm) Fixed in 5.23.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
Not affected: 1 product
- Logging Subsystem for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26486
- 2026-10-03 Alias added: GHSA-4vq7-882g-wcg4
References
Exploit 2
- https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4
- https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA
Other 4
- https://github.com/vega/vega/releases/tag/v5.23.0
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6
- https://github.com/vega/vega
More vega vulnerabilities
- TI-2025-40262 Cross-site scripting in vega CVSS 3.1CRITICAL 9.3
- TI-2025-18958 Vega allows Cross-site Scripting via the vlSelectionTuples function CVSS 4.0MEDIUM 6.9
- TI-2025-37279 Cross-site scripting in vega CVSS 3.1HIGH 8.1
- TI-2025-19556 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVSS 4.0MEDIUM 5.3
- TI-2020-16117 Cross-site scripting in vega CVSS 3.1HIGH 8.7
- TI-2026-02866 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVSS 3.1HIGH 7.5
Sources
- CVE-2023-26486 · CVE Program
- CVE-2023-26486 · NVD
- FIRST EPSS
- GHSA-4vq7-882g-wcg4 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26486 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences