Cross-site Scripting (XSS)

2023-03-1009:14:52

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vega

lassoappend

vulnerability

function

attacker

object

push

event view

EPSS

0.001

Percentile

45.3%

JSON

vega is vulnerable to Cross-site Scripting (XSS) attacks. The library does not properly enforce types for its arguments in the lassoAppend function, which allows an attacker to specify any object with a push function. The push function then can be set to any function that has the access to event.view.