{"id":"DEBIAN-CVE-2023-26486","details":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.","modified":"2026-09-15T09:01:11.192726197Z","published":"2023-03-04T00:15:15.473Z","upstream":["CVE-2023-26486"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-26486"}],"affected":[{"package":{"name":"vega.js","ecosystem":"Debian:12","purl":"pkg:deb/debian/vega.js?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+ds+~3.1.0-4","5.25.0+ds+~cs5.3.0-1","5.25.0+ds+~cs5.3.0-2","5.25.0+ds+~cs5.3.0-3","5.25.0+ds+~cs5.3.0-4","5.25.0+ds+~cs5.3.0-5","5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2","5.28.0+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-1","5.33.1+ds+~cs5.3.0-2","5.33.1+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-26486.json"}},{"package":{"name":"vega.js","ecosystem":"Debian:13","purl":"pkg:deb/debian/vega.js?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0+ds+~cs5.3.0-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-26486.json"}},{"package":{"name":"vega.js","ecosystem":"Debian:14","purl":"pkg:deb/debian/vega.js?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.0+ds+~cs5.3.0-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-26486.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}