Vulnerabilities > CVE-2020-26296 - Unspecified vulnerability in Vega Project Vega

CVSS 8.7 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

vega-project

NVD

Published: 2020-12-30

Updated: 2024-11-21

Summary

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3

Vulnerable Configurations

Part	Description	Count
Application	Vega_Project Vega Project Vega 1.0.0 Vega Project Vega 1.1.0 Vega Project Vega 1.2.0 Vega Project Vega 1.3.0 Vega Project Vega 1.3.1 Vega Project Vega 1.3.2 Vega Project Vega 1.3.3 Vega Project Vega 1.3.4 Vega Project Vega 1.4.0 Vega Project Vega 1.4.1 Vega Project Vega 1.4.2 Vega Project Vega 1.4.3 Vega Project Vega 1.5.0 Vega Project Vega 1.5.3 Vega Project Vega 1.5.4 Vega Project Vega 2.0.0 Vega Project Vega 2.0.1 Vega Project Vega 2.0.2 Vega Project Vega 2.0.3 Vega Project Vega 2.0.4 Vega Project Vega 2.0.5 Vega Project Vega 2.0.6 Vega Project Vega 2.1.0 Vega Project Vega 2.1.1 Vega Project Vega 2.1.2 Vega Project Vega 2.2.0 Vega Project Vega 2.2.1 Vega Project Vega 2.2.2 Vega Project Vega 2.2.3 Vega Project Vega 2.2.4 Vega Project Vega 2.2.5 Vega Project Vega 2.2.6 Vega Project Vega 2.3.0 Vega Project Vega 2.3.1 Vega Project Vega 2.4.0 Vega Project Vega 2.4.1 Vega Project Vega 2.4.2 Vega Project Vega 2.5.0 Vega Project Vega 2.5.1 Vega Project Vega 2.5.2 Vega Project Vega 2.6.0 Vega Project Vega 2.6.1 Vega Project Vega 2.6.2 Vega Project Vega 2.6.3 Vega Project Vega 2.6.4 Vega Project Vega 2.6.5 Vega Project Vega 3.0.0 Vega Project Vega 3.0.1 Vega Project Vega 3.0.2 Vega Project Vega 3.0.3 Vega Project Vega 3.0.4 Vega Project Vega 3.0.5 Vega Project Vega 3.0.6 Vega Project Vega 3.0.7 Vega Project Vega 3.0.8 Vega Project Vega 3.0.9 Vega Project Vega 3.0.10 Vega Project Vega 3.1.0 Vega Project Vega 3.2.0 Vega Project Vega 3.2.1 Vega Project Vega 3.3.0 Vega Project Vega 3.3.1 Vega Project Vega 4.0.0 Vega Project Vega 4.1.0 Vega Project Vega 4.2.0 Vega Project Vega 4.3.0 Vega Project Vega 4.4.0 Vega Project Vega 5.0.0 Vega Project Vega 5.1.0 Vega Project Vega 5.2.0 Vega Project Vega 5.3.0 Vega Project Vega 5.3.1 Vega Project Vega 5.3.2 Vega Project Vega 5.3.3 Vega Project Vega 5.3.4 Vega Project Vega 5.3.5 Vega Project Vega 5.4.0 Vega Project Vega 5.5.0 Vega Project Vega 5.5.1 Vega Project Vega 5.5.2 Vega Project Vega 5.5.3 Vega Project Vega 5.6.0 Vega Project Vega 5.7.0 Vega Project Vega 5.7.1 Vega Project Vega 5.7.2 Vega Project Vega 5.7.3 Vega Project Vega 5.8.0 Vega Project Vega 5.8.1 Vega Project Vega 5.9.0 Vega Project Vega 5.9.1 Vega Project Vega 5.9.2 Vega Project Vega 5.10.0 Vega Project Vega 5.10.1 Vega Project Vega 5.11.0 Vega Project Vega 5.11.1 Vega Project Vega 5.12.0 Vega Project Vega 5.12.1 Vega Project Vega 5.12.2 Vega Project Vega 5.12.3 Vega Project Vega 5.13.0 Vega Project Vega 5.14.0 Vega Project Vega 5.15.0 Vega Project Vega 5.16.0 Vega Project Vega 5.16.1 Vega Project Vega 5.17.0 Vega Project Vega 5.17.1 Vega Project Vega 5.17.2	162

Summary

Vulnerable Configurations

References