npm/vega CVE-2023-26487: medium 6.1, EPSS 0.81%
Vega has Cross-site Scripting vulnerability in `lassoAppend` function
Action: Upgrade vega to 5.23.0 or later.
npm i vega@5.23.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.23.0 | - |
Fixed versions
| 5.23.0 |
Sources
- osv: GHSA-w5m3-xh75-mp55
- https://github.com/vega/vega/security/advisories/GHSA-w5m3-xh75-mp55
- https://nvd.nist.gov/vuln/detail/CVE-2023-26487
- https://github.com/vega/vega/commit/01adb034f24727d3bb321bbbb6696a7f4cd91689
- https://github.com/vega/vega
- https://github.com/vega/vega/releases/tag/v5.23.0
CVE-2023-26487 · published · modified · JSON