| Package | Affected versions | Patched versions |
|---|---|---|
| vega | < 5.26.0 | 5.26.0 |
| vega-selections | < 5.4.2 | 5.4.2 |
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
vlSelectionTuples calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument.
Example call: vlSelectionTuples([{datum:<argument>}], {fields:[{getter:<function>}]})
This can be used to call Function() with arbitrary JavaScript and the resulting function can be called with vlSelectionTuples or using a type coercion to call toString or valueOf.
{"$schema":"https://vega.github.io/schema/vega/v5.json","signals":[{"name":"a","init":"+{valueOf:vlSelectionTuples([{datum:'alert(1)'}],{fields:[{getter:[].at.constructor}]})[0].values[0]}"}]}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free