Executive brief
The Vega visualization grammar library's scale expression function fails to properly validate user-supplied arguments, allowing attackers to escape the expression sandbox and execute arbitrary JavaScript code in the browser. This affects applications using Vega to render user-supplied visualization definitions, potentially enabling session hijacking, credential theft, or malware injection.
Technical details
The vulnerability exists in the Vega expression language's scale function, which accepts a user-supplied argument group parameter and passes it to the getScale function. The vulnerable code then accesses context.scales[name].value from the group parameter and calls it as a function, without proper validation. An attacker can craft a malicious Vega visualization definition that passes a specially constructed object as the group argument, allowing arbitrary functions (such as eval or constructor functions) to be invoked with attacker-controlled code. This sandbox escape requires no authentication and can be triggered by loading a malicious Vega visualization in the browser. The vulnerability was patched in vega v5.23.0 and vega-functions v5.13.1.
Affected products
- Vega vega < 5.23.0
- Vega vega-functions < 5.13.1
Timeline
- 2023-03-02: disclosed: Advisory published
- 2023-03-01: patched: vega v5.23.0 and vega-functions v5.13.1 released with fix
References
- https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4
- https://github.com/vega/vega
- https://github.com/vega/vega/releases/tag/v5.23.0
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js
- https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js
- https://vega.github.io/editor/