Executive brief
Vega-functions is a JavaScript library used to build interactive data visualizations. A cross-site scripting (XSS) vulnerability in the setdata function allows attackers to inject and execute arbitrary JavaScript code when users supply untrusted input to visualizations. This can result in session hijacking, credential theft, or malware distribution through compromised charts and dashboards.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in vega-functions' internal setdata function, which uses the modify() expression method. The modify() function allows attackers to control both the method being invoked and the values supplied to it, enabling arbitrary JavaScript execution. No authentication or user interaction is required; the attack succeeds when untrusted user input is processed in a Vega specification. The vulnerability affects all versions through 6.1.0 and is fixed in 6.1.1. Standard Content Security Policy mitigations do not prevent this attack.
Affected products
- Vega vega-functions through 6.1.0
Timeline
- 2026-01-05: disclosed
- 2026-01-05: patched: Fixed in vega-functions 6.1.1