Strix
26.1K

CVE-2023-26486

MEDIUMCVSS 6.1/10EPSS 0.78%

Last modified

CVE-2023-26486 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. EPSS estimates a 0.78% chance of exploitation in the next 30 days.

Description

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
0.78%

51.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Vega-Functions ProjectVega-Functions< 5.13.1
Vega ProjectVega< 5.23.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-26486?
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
How severe is CVE-2023-26486?
CVE-2023-26486 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.78% probability of exploitation in the next 30 days.
How do I fix CVE-2023-26486?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-26486?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST