CVE-2020-26296

CVE-2020-26296 describes an XSS vulnerability in Vega, an npm package for creating interactive visualizations, affecting versions prior to 5.17.3. An attacker could exploit this by crafting a malicious Vega expression to execute arbitrary JavaScript on a victim's machine. This vulnerability carries a high CVSS score of 8.7, indicating a network-based attack with low complexity, requiring user interaction, and leading to high impact on confidentiality and integrity. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the vulnerability's nature warrants attention.