A critical vulnerability in the Vega visualization library allows unauthenticated attackers to achieve arbitrary JavaScript execution, posing a significant risk of cross-site scripting.

The vulnerability involves improper neutralization of input, categorized as CWE-79, which allows for arbitrary JavaScript code execution. This occurs when the Vega library and View instances are attached to the global window and the application processes user-provided JSON definitions.

The ability for an attacker to execute arbitrary JavaScript within a user's browser context can lead to full session hijacking, theft of sensitive user data, and unauthorized actions performed on behalf of the victim. With a CVSS score of 8.1, this high-severity vulnerability represents a substantial risk to application integrity and user privacy, particularly for platforms that allow users to generate or share interactive visualizations.

Immediate Action: Update the Vega library to version 6.2.0, vega-expression to 6.1.0 (or 5.2.1 for non-ESM), and vega-interpreter to 2.2.1 (or 1.2.1 for non-ESM) immediately.

Proactive Monitoring: Audit application code to ensure that Vega library instances and View objects are not attached to the global window or the global browser context.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of potential cross-site scripting attempts until patches are deployed.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for arbitrary code execution and the existence of a proof-of-concept, organizations using Vega must prioritize these updates. Please verify your current environment for the vulnerable library versions and ensure that global scope exposure is eliminated to prevent exploitation of this flaw.