Threats tagged 'ghsa-7f2v-3qq3-vvjf'

A high-severity cross-site scripting (XSS) vulnerability exists in the Vega visualization library when applications expose the Vega library and View instances globally and allow user-defined Vega JSON definitions. This flaw enables arbitrary JavaScript code execution via crafted expressions abusing toString calls, even when Vega's safe mode expression interpreter is used. The vulnerability is fixed in Vega versions 6.2.0, 6.1.0, 2.2.1, 1.2.1, and 5.2.1. Workarounds include avoiding attaching Vega or Vega View instances to global variables. Exploitation requires conditions that expose the VEGA_DEBUG global and allow untrusted JSON input.