{"action":"Upgrade vega-functions to 5.13.1 or later.","affected":[{"fixed":"5.13.1","introduced":"0"}],"component":"vega-functions","cve_ids":["CVE-2023-26486"],"ecosystem":"npm","epss":0.00775,"exploited":false,"fixed_versions":["5.13.1"],"ghsa_id":"GHSA-4vq7-882g-wcg4","id":"tcs_01M5KF1K00FDCH5N9PX4Y7TMJ8","modified_at":"2026-09-10T03:49:52.396334240Z","published_at":"2023-03-02T23:11:05Z","references":["https://osv.dev/vulnerability/GHSA-4vq7-882g-wcg4","https://github.com/vega/vega/security/advisories/GHSA-4vq7-882g-wcg4","https://nvd.nist.gov/vuln/detail/CVE-2023-26486","https://github.com/vega/vega","https://github.com/vega/vega/releases/tag/v5.23.0","https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37","https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6","https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-4vq7-882g-wcg4","url":"https://osv.dev/vulnerability/GHSA-4vq7-882g-wcg4"}],"summary":"Vega Expression Language `scale` expression function Cross Site Scripting"}