# CVE-2023-26486: Vega Expression Language scale function cross-site scripting

Source: https://junglewise.ai/threats/cve-2023-26486-vega-expression-language-scale-function-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26486 · Severity: low · CVSS 3.1 · Published 2023-03-02

The Vega visualization grammar library's scale expression function fails to properly validate user-supplied arguments, allowing attackers to escape the expression sandbox and execute arbitrary JavaScript code in the browser. This affects applications using Vega to render user-supplied visualization definitions, potentially enabling session hijacking, credential theft, or malware injection.

Technologies: [vega (npm)](https://junglewise.ai/threats/technologies/vega), [vega-functions (npm)](https://junglewise.ai/threats/technologies/vega-functions). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26486 being exploited in the wild.

**How severe is CVE-2023-26486?** Low severity, with a CVSS score of 3.1, published 2 March 2023.

**Which products and versions are affected?** vega (npm) SEMVER:introduced=0,fixed=5.23.0; vega-functions (npm) SEMVER:introduced=0,fixed=5.13.1.

**Is there a fix for CVE-2023-26486?** Yes. vega (npm): upgrade to 5.23.0 or later; vega-functions (npm): upgrade to 5.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26486 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26486?** Check whether you run vega (npm) or vega-functions (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vega (npm): upgrade to 5.23.0 or later

  ```sh
  npm install vega@5.23.0
  ```

- vega-functions (npm): upgrade to 5.13.1 or later

  ```sh
  npm install vega-functions@5.13.1
  ```


## Technical details

The vulnerability exists in the Vega expression language's scale function, which accepts a user-supplied argument group parameter and passes it to the getScale function. The vulnerable code then accesses context.scales[name].value from the group parameter and calls it as a function, without proper validation. An attacker can craft a malicious Vega visualization definition that passes a specially constructed object as the group argument, allowing arbitrary functions (such as eval or constructor functions) to be invoked with attacker-controlled code. This sandbox escape requires no authentication and can be triggered by loading a malicious Vega visualization in the browser. The vulnerability was patched in vega v5.23.0 and vega-functions v5.13.1.

## Affected products

- Vega vega < 5.23.0
- Vega vega-functions < 5.13.1

## Identifiers

- CVE-2023-26486
- GHSA-4vq7-882g-wcg4

## Timeline

- 2023-03-02: disclosed: Advisory published
- 2023-03-01: patched: vega v5.23.0 and vega-functions v5.13.1 released with fix

## References

- [https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4](https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4)
- [https://github.com/vega/vega](https://github.com/vega/vega)
- [https://github.com/vega/vega/releases/tag/v5.23.0](https://github.com/vega/vega/releases/tag/v5.23.0)
- [https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js](https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js)
- [https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js](https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js)
- [https://vega.github.io/editor/](https://vega.github.io/editor/)

## Related threats

- [Vega vega-functions cross-site scripting in setdata function](https://junglewise.ai/threats/cve-2025-66648-vega-vega-functions-cross-site-scripting-in-setdata-function)
- [Vega Cross-Site Scripting via toString in VEGA_DEBUG](https://junglewise.ai/threats/cve-2025-59840-vega-cross-site-scripting-via-tostring-in-vega-debug)
- [Vega cross-site scripting via RegExp.prototype[@@replace]](https://junglewise.ai/threats/cve-2025-27793-vega-cross-site-scripting-via-regexp-prototype-replace)
- [Vega Cross-Site Scripting via event filter in expression interpreter](https://junglewise.ai/threats/cve-2025-26619-vega-cross-site-scripting-via-event-filter-in-expression)
- [Vega cross-site scripting in vlSelectionTuples function](https://junglewise.ai/threats/cve-2025-25304-vega-cross-site-scripting-in-vlselectiontuples-function)