Read the docs
TI-2023-11634 Aliases CVE-2023-26487GHSA-w5m3-xh75-mp55

Vega has cross-site scripting vulnerability in `lassoAppend` function

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00806 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vega (vega): 5.23.0vega (npm): 5.23.0+1 more productRed Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vegavegabefore 5.23.05.23.0Patch availableCNA
—vega (npm)before 5.23.05.23.0Patch availableGHSA-w5m3-xh75-mp55
—vega-functions (npm)before 5.13.15.13.1Patch availableGHSA-w5m3-xh75-mp55
  • vega Vendorvega Affected before 5.23.0 Fixed in 5.23.0 Patch available CNA
  • vega (npm) Vendor— Affected before 5.23.0 Fixed in 5.23.0 Patch available GHSA-w5m3-xh75-mp55
  • vega-functions (npm) Vendor— Affected before 5.13.1 Fixed in 5.13.1 Patch available GHSA-w5m3-xh75-mp55

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:*before 5.13.1VulnerableVega-functions Project
cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:*before 5.23.0VulnerableVega Project
  • cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:* Versions before 5.13.1 Vulnerable ·Vega-functions Project
  • cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:* Versions before 5.23.0 Vulnerable ·Vega Project

Remediation

  • Fix · CNA vega (vega) Fixed in 5.23.0
  • Fix · GHSA-w5m3-xh75-mp55 vega (npm) Fixed in 5.23.0 Advisory →
  • Fix · GHSA-w5m3-xh75-mp55 vega-functions (npm) Fixed in 5.13.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Not affected: 1 product
  • Logging Subsystem for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26487
  2. 2026-10-03 Alias added: GHSA-w5m3-xh75-mp55

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2025-40262 Cross-site scripting in vega CVSS 3.1CRITICAL 9.3
  • TI-2025-18958 Vega allows Cross-site Scripting via the vlSelectionTuples function CVSS 4.0MEDIUM 6.9
  • TI-2025-37279 Cross-site scripting in vega CVSS 3.1HIGH 8.1
  • TI-2025-19556 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVSS 4.0MEDIUM 5.3
  • TI-2020-16117 Cross-site scripting in vega CVSS 3.1HIGH 8.7
  • TI-2026-02866 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences