Is CVE-2023-26486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-26486 being exploited in the wild.

How severe is CVE-2023-26486?

Low severity, with a CVSS score of 3.1, published 2 March 2023.

Which products and versions are affected?

vega (npm) SEMVER:introduced=0,fixed=5.23.0; vega-functions (npm) SEMVER:introduced=0,fixed=5.13.1.

Is there a fix for CVE-2023-26486?

Yes. vega (npm): upgrade to 5.23.0 or later; vega-functions (npm): upgrade to 5.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-26486 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-26486?

Check whether you run vega (npm) or vega-functions (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-26486: Vega Expression Language scale function cross-site scripting

CVE-2023-26486 · Severity: low · CVSS 3.1 · Published 2023-03-02

The Vega visualization grammar library's scale expression function fails to properly validate user-supplied arguments, allowing attackers to escape the expression sandbox and execute arbitrary JavaScript code in the browser. This affects applications using Vega to render user-supplied visualization definitions, potentially enabling session hijacking, credential theft, or malware injection.

Technologies: vega (npm), vega-functions (npm). Vendors: npm.

Quick answers

Is CVE-2023-26486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-26486 being exploited in the wild.
How severe is CVE-2023-26486?: Low severity, with a CVSS score of 3.1, published 2 March 2023.
Which products and versions are affected?: vega (npm) SEMVER:introduced=0,fixed=5.23.0; vega-functions (npm) SEMVER:introduced=0,fixed=5.13.1.
Is there a fix for CVE-2023-26486?: Yes. vega (npm): upgrade to 5.23.0 or later; vega-functions (npm): upgrade to 5.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26486 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-26486?: Check whether you run vega (npm) or vega-functions (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vega (npm): upgrade to 5.23.0 or later
```
npm install vega@5.23.0
```
vega-functions (npm): upgrade to 5.13.1 or later
```
npm install vega-functions@5.13.1
```

Technical details

The vulnerability exists in the Vega expression language's scale function, which accepts a user-supplied argument group parameter and passes it to the getScale function. The vulnerable code then accesses context.scales[name].value from the group parameter and calls it as a function, without proper validation. An attacker can craft a malicious Vega visualization definition that passes a specially constructed object as the group argument, allowing arbitrary functions (such as eval or constructor functions) to be invoked with attacker-controlled code. This sandbox escape requires no authentication and can be triggered by loading a malicious Vega visualization in the browser. The vulnerability was patched in vega v5.23.0 and vega-functions v5.13.1.

Affected products

Vega vega < 5.23.0
Vega vega-functions < 5.13.1

Identifiers

CVE-2023-26486
GHSA-4vq7-882g-wcg4

Timeline

2023-03-02: disclosed: Advisory published
2023-03-01: patched: vega v5.23.0 and vega-functions v5.13.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.