{
  "cveId": "CVE-2023-26487",
  "url": "https://patchblox.com/security/cve/CVE-2023-26487",
  "summary": "CVE-2023-26487 is fixed in vega.js on 1 platform, first by DEBIAN-CVE-2023-26487, released March 4, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "vega.js: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization des...",
  "description": "Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.\u0060lassoAppend\u0027 function accepts 3 arguments and internally invokes \u0060push\u0060 function on the 1st argument specifying array consisting of 2nd and 3rd arguments as \u0060push\u0060 call argument. The type of the 1st argument is supposed to be an array, but it\u0027s not enforced. This makes it possible to specify any object with a \u0060push\u0060 function as the 1st argument, \u0060push\u0060 function can be set to any function that can be access via \u0060event.view\u0060 (no all such functions can be exploited due to invalid context or signature, but some can, e.g. \u0060console.log\u0060). The issue is that\u0060lassoAppend\u0060 doesn\u0027t enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS \u0060setImmediate\u0060 polyfill basically allows \u0060eval\u0060-like functionality). This issue was patched in 5.23.0.",
  "published": "2023-03-04T00:15:15Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00806,
  "epssPercentile": 0.57037,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "vega.js",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.25.0\u002Bds\u002B~cs5.3.0-1",
      "fix": "DEBIAN-CVE-2023-26487",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-26487",
      "released": "2023-03-04T00:15:15Z"
    },
    {
      "platform": "linux",
      "product": "vega.js",
      "release": "Debian 14",
      "fixedVersion": "5.25.0\u002Bds\u002B~cs5.3.0-1",
      "fix": "DEBIAN-CVE-2023-26487",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-26487",
      "released": "2023-03-04T00:15:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}