CVE-2023-26487 is a cross-site scripting (XSS) vulnerability affecting Vega, a visualization grammar, specifically within the 'lassoAppend' function. This function fails to enforce proper type checking for its first argument, allowing an attacker to supply an object with a malicious 'push' function. This can lead to XSS, with the exact impact varying based on the execution environment. The vulnerability has a CVSS score of 6.1 (MEDIUM), indicating a network-based attack requiring user interaction, with low impact on confidentiality and integrity, and no impact on availability. While the EPSS score is very low, suggesting limited exploitability, the FAUCET Risk Score is 31/100. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage. The issue was patched in Vega version 5.23.0.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.13.1CPE matchmatch criteria | cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:* | ||
< 5.23.0CPE matchmatch criteria | cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.