Arbitrary JavaScript Execution Vulnerability in Vega Selections Package
Summary
GHSA-829q-m3qg-ph8r: Impact Applications meeting these two conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. Affects vega-selections across 2 version ranges.
< 5.6.3
>= 6.0.0, < 6.1.2
Fixed in 5.6.3 or 6.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vega is a visualization grammar that enables the creation of interactive graphics and visualizations in web applications. The vega-selections package is a core component of Vega, providing functionality for managing selections in visualizations. This package allows users to define and manipulate selections based on user interactions. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack, which can lead to arbitrary JavaScript code execution if certain conditions are met.
Vulnerability Detail
The vulnerability arises from the improper handling of user-defined Vega JSON definitions when the vega library and a vega.View instance are attached to the global window. This allows an attacker to exploit the vlSelectionTuples function by passing a crafted object that executes arbitrary JavaScript code via the map function. The exploitation can lead to DOM XSS, potentially allowing attackers to steal sensitive information or manipulate user data. The vulnerability is particularly concerning because it can be triggered by user interactions, making it a significant risk for applications using the affected versions of the vega-selections package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.6.35.6.3npm install vega-selections@5.6.3 -
>= 6.0.0, < 6.1.26.1.2npm install vega-selections@6.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid attaching the vega or vega.View instances to global variables or the window. This practice should not be used in any situation where Vega/Vega-lite definitions can come from untrusted sources. For example, ensure that your code does not include lines like the following:
window.vega = vega;
window.vegaView = new vega.View(...);
Conclusion
The vega-selections package has a critical vulnerability that allows for arbitrary JavaScript execution through improper handling of user-defined JSON definitions. It is crucial for developers using this package to update to the latest patched versions and implement recommended workarounds to mitigate risks. Regular monitoring and vulnerability assessments are essential to maintain application security.
See every vulnerability recorded for vega-selections →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to DOM XSS, allowing attackers to execute arbitrary JavaScript in the context of the application, which can compromise sensitive information and user data.
Yes, you can mitigate the risk by avoiding the use of global variables for vega or vega.View instances and ensuring that user-defined Vega JSON definitions are not accepted from untrusted sources.
If you encounter this vulnerability, you should prioritize updating the vega-selections package to the patched version and review your application's code to ensure that it does not expose any global function gadgets.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
