GitHub Advisoryadvisory · npm
GHSA-cp47-r258-q626 Vega vulnerable to arbitrary code execution when clicking href links
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- vega
- Severity
- Moderate
- Reviewed
- 2023-03-02
Affected packages
• npm vega: >= 5.0.0, < 5.4.1 → fixed in 5.4.1
• npm vega: < 4.5.1 → fixed in 4.5.1
Description
Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.
References
- https://github.com/vega/vega/security/advisories/GHSA-cp47-r258-q626 web
- https://github.com/vega/vega/pull/1892 web
- https://github.com/vega/vega/commit/692327013eb4dd5adec0c47a620181af1b135e2a web
- https://github.com/vega/vega package
- https://github.com/vega/vega/commits/v4.5.1 web
- https://github.com/vega/vega/commits/v5.4.1 web