https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:18:43 +0000 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0353 certfr-2023-avi-0353 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0353 https://cve.radiocsirt.org/vuln/euvd-2026-218925 EUVD-2026-218925 https://cve.radiocsirt.org/vuln/euvd-2026-218925 https://cve.radiocsirt.org/vuln/fkie_cve-2023-26487 <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend&#39; function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it&#39;s not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn&#39;t enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.</p> <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend&#39; function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it&#39;s not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn&#39;t enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-26487 https://cve.radiocsirt.org/vuln/ghsa-w5m3-xh75-mp55 <p><strong>Affected:</strong> npm: vega, npm: vega-functions</p> <p>### Summary</p> <p>Vega&#39;s `lassoAppend` function: `lassoAppend` accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it&#39;s not enforced.</p> <p>This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`).</p> <p>### Details The issue is that [`lassoAppend`](https://github.com/vega/vega/blob/7eafbbd4d53d0ce9f08e74ff96c90d411b1bb80a/packages/vega-functions/src/functions/lasso.js#L13) doesn&#39;t enforce proper types of its arguments: ```js ..... export function lassoAppend(lasso, x, y, minDist = 5) { const last = lasso[lasso.length - 1];</p> <p>// Add point to lasso if distance to last point exceed minDist or its the first point if (last === undefined || Math.sqrt(((last[0] - x) ** 2) + ((last[1] - y) ** 2)) &gt; minDist) { lasso.push([x, y]); ..... ```</p> <p>### PoC</p> <p>Use the following Vega snippet (depends on browser&#39;s non-built-in `event.view.setImmediate` function, feel free to replace with `event.view.console.log` or alike and observe the result in the browser&#39;s console)</p> <p>```json { &#34;$schema&#34;: &#34;https://vega.github.io/schema/vega/v5.json&#34;, &#34;width&#34;: 350, &#34;height&#34;: 350, &#34;autosize&#34;: &#34;none&#34;, &#34;description&#34;: &#34;T…</p> <p><strong>Affected:</strong> npm: vega, npm: vega-functions</p> <p>### Summary</p> <p>Vega&#39;s `lassoAppend` function: `lassoAppend` accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it&#39;s not enforced.</p> <p>This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`).</p> <p>### Details The issue is that [`lassoAppend`](https://github.com/vega/vega/blob/7eafbbd4d53d0ce9f08e74ff96c90d411b1bb80a/packages/vega-functions/src/functions/lasso.js#L13) doesn&#39;t enforce proper types of its arguments: ```js ..... export function lassoAppend(lasso, x, y, minDist = 5) { const last = lasso[lasso.length - 1];</p> <p>// Add point to lasso if distance to last point exceed minDist or its the first point if (last === undefined || Math.sqrt(((last[0] - x) ** 2) + ((last[1] - y) ** 2)) &gt; minDist) { lasso.push([x, y]); ..... ```</p> <p>### PoC</p> <p>Use the following Vega snippet (depends on browser&#39;s non-built-in `event.view.setImmediate` function, feel free to replace with `event.view.console.log` or alike and observe the result in the browser&#39;s console)</p> <p>```json { &#34;$schema&#34;: &#34;https://vega.github.io/schema/vega/v5.json&#34;, &#34;width&#34;: 350, &#34;height&#34;: 350, &#34;autosize&#34;: &#34;none&#34;, &#34;description&#34;: &#34;T…</p> https://cve.radiocsirt.org/vuln/ghsa-w5m3-xh75-mp55 https://cve.radiocsirt.org/vuln/gsd-2023-26487 gsd-2023-26487 https://cve.radiocsirt.org/vuln/gsd-2023-26487