CVSS 3.1
8.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NCVE-2020-26296
High (8.7) in vega project vega. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in vega 5.17.3.
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vega_project:vega
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r2qc-w64x-6j54 | npm | vega | <5.17.3 | 5.17.3 |