CVE-2020-26296

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
vega	vega	< 5.17.3

References

https://github.com/vega/vega/issues/3018Third Party Advisory
https://github.com/vega/vega/pull/3019Third Party Advisory
https://github.com/vega/vega/releases/tag/v5.17.3Release Notes, Third Party Advisory
https://github.com/vega/vega/security/advisories/GHSA-r2qc-w64x-6j54Third Party Advisory
https://www.npmjs.com/package/vegaThird Party Advisory
https://github.com/vega/vega/issues/3018Third Party Advisory
https://github.com/vega/vega/pull/3019Third Party Advisory
https://github.com/vega/vega/releases/tag/v5.17.3Release Notes, Third Party Advisory
https://github.com/vega/vega/security/advisories/GHSA-r2qc-w64x-6j54Third Party Advisory
https://www.npmjs.com/package/vegaThird Party Advisory

Timeline

Published: Dec 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-262976.1mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vul CVE-2020-262985.4Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable CVE-2020-262999.6ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulne CVE-2020-26306.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported v CVE-2020-263009.8systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 CVE-2020-2630110.0ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerab CVE-2020-263027.5is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Ex CVE-2020-263037.5insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regul CVE-2020-263047.5Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Express CVE-2020-263057.5CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Re CVE-2020-263068.7Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior CVE-2020-263078.7HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expres