From 93134b8f5297952e8d39c7ed3872909a3a24e600 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 11 Apr 2025 19:04:05 +0000
Subject: [PATCH] Publish GHSA-rcw3-wmx7-cphr

---
 .../2025/03/GHSA-rcw3-wmx7-cphr/GHSA-rcw3-wmx7-cphr.json    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/advisories/github-reviewed/2025/03/GHSA-rcw3-wmx7-cphr/GHSA-rcw3-wmx7-cphr.json b/advisories/github-reviewed/2025/03/GHSA-rcw3-wmx7-cphr/GHSA-rcw3-wmx7-cphr.json
index e144d8208fa..9ce7cfab756 100644
--- a/advisories/github-reviewed/2025/03/GHSA-rcw3-wmx7-cphr/GHSA-rcw3-wmx7-cphr.json
+++ b/advisories/github-reviewed/2025/03/GHSA-rcw3-wmx7-cphr/GHSA-rcw3-wmx7-cphr.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rcw3-wmx7-cphr",
-  "modified": "2025-03-27T23:29:47Z",
+  "modified": "2025-04-11T19:02:04Z",
   "published": "2025-03-27T14:12:34Z",
   "aliases": [
     "CVE-2025-26619"
@@ -9,6 +9,10 @@
   "summary": "Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter",
   "details": "### Impact\n\nIn `vega` 5.30.0 and lower,  `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported.\n\n### Patches\n\nPatched in `vega` `5.31.0`  / `vega-functions` `5.16.0`\n\n### Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. \n- Using the interpreter [described in CSP safe mode](https://vega.github.io/vega/usage/interpreter/) (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.\n\n### References\n\n- Reported to Vega-Lite by @kprevas Nov 8 2024 in https://github.com/vega/vega-lite/issues/9469 &  https://github.com/vega/vega/issues/3984\n\nReproduction of the error in Vega by @mattijn \n\n```\n{\n  \"$schema\": \"https://vega.github.io/schema/vega/v5.json\",\n  \"signals\": [\n    {\n      \"name\": \"inject_alert\",\n      \"on\": [\n        {\n          \"events\": [\n            {\n              \"type\": \"mousedown\",\n              \"marktype\": \"rect\",\n              \"filter\": [\"scale(event.view.setTimeout, 'alert(\\\"alert\\\")')\"]\n            }\n          ],\n          \"update\": \"datum\"\n        }\n      ]\n    }\n  ],\n  \"marks\": [\n    {\n      \"type\": \"rect\",\n      \"encode\": {\n        \"update\": {\n          \"x\": {\"value\": 0},\n          \"y\": {\"value\": 0},\n          \"width\": {\"value\": 100},\n          \"height\": {\"value\": 100}\n        }\n      }\n    }\n  ]\n}\n```",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"