{"id":"GHSA-cp47-r258-q626","aliases":[],"status":"published","title":"Vega vulnerable to arbitrary code execution when clicking href links","description":"Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-03-02T23:36:22Z","modified":"2023-03-02T23:36:23Z","fixes":[{"ecosystem":"npm","package":"vega","fixed_in":["5.4.1","4.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"vega","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"vega","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}]}],"references":[{"url":"https://github.com/vega/vega/security/advisories/GHSA-cp47-r258-q626","tags":["web"]},{"url":"https://github.com/vega/vega/pull/1892","tags":["web"]},{"url":"https://github.com/vega/vega/commit/692327013eb4dd5adec0c47a620181af1b135e2a","tags":["web"]},{"url":"https://github.com/vega/vega/commits/v4.5.1","tags":["web"]},{"url":"https://github.com/vega/vega/commits/v5.4.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cp47-r258-q626"},{"url":"https://github.com/vega/vega","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-cp47-r258-q626","title":" Vega vulnerable to arbitrary code execution when clicking href links","description":" Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.","status":"published","published":"2023-03-02T23:36:22Z","modified":"2023-03-02T23:36:23Z","updated_at":"2026-11-02T14:36:46.526285Z"}],"osv":[{"id":"GHSA-cp47-r258-q626","title":" Vega vulnerable to arbitrary code execution when clicking href links","description":" Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.","status":"published","published":"2023-03-02T23:36:22Z","modified":"2023-03-02T23:36:22Z","updated_at":"2026-11-02T15:46:45.28161Z"}]}}