{"action":"Upgrade vega to 5.23.0 or later.","affected":[{"fixed":"5.23.0","introduced":"0"}],"component":"vega","cve_ids":["CVE-2023-26487"],"ecosystem":"npm","epss":0.00806,"exploited":false,"fixed_versions":["5.23.0"],"ghsa_id":"GHSA-w5m3-xh75-mp55","id":"tcs_01M5KGE1AFF3N4NWQX48610JVT","modified_at":"2026-09-10T03:49:57.054220465Z","published_at":"2023-03-02T23:08:21Z","references":["https://osv.dev/vulnerability/GHSA-w5m3-xh75-mp55","https://github.com/vega/vega/security/advisories/GHSA-w5m3-xh75-mp55","https://nvd.nist.gov/vuln/detail/CVE-2023-26487","https://github.com/vega/vega/commit/01adb034f24727d3bb321bbbb6696a7f4cd91689","https://github.com/vega/vega","https://github.com/vega/vega/releases/tag/v5.23.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-w5m3-xh75-mp55","url":"https://osv.dev/vulnerability/GHSA-w5m3-xh75-mp55"}],"summary":"Vega has Cross-site Scripting vulnerability in `lassoAppend` function"}