Описание
Vega allows Cross-site Scripting via the vlSelectionTuples function
Summary
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
Details
vlSelectionTuples calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument.
Example call: vlSelectionTuples([{datum:<argument>}], {fields:[{getter:<function>}]})
This can be used to call Function() with arbitrary JavaScript and the resulting function can be called with vlSelectionTuples or using a type coercion to call toString or valueOf.
PoC
Ссылки
- https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j
- https://nvd.nist.gov/vuln/detail/CVE-2025-25304
- https://github.com/vega/vega/commit/9fb9ea07e27984394e463d286eb73944fa61411e
- https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14
Пакеты
vega
< 5.26.0
5.26.0
vega-selections
< 5.4.2
5.4.2
Связанные уязвимости
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
Vega is a visualization grammar, a declarative format for creating, sa ...