A critical DOM-based Cross-site Scripting vulnerability in the Vega visualization library allows unauthenticated attackers to execute arbitrary JavaScript code in the context of a user session.

This vulnerability is a DOM-based Cross-site Scripting (CWE-79) flaw that occurs when the library processes user-supplied Vega JSON definitions. If an application exposes global function gadgets or attaches a Vega view instance to the global window, an unauthenticated attacker can trick a user into opening a malicious specification to execute arbitrary scripts.

The exploitation of this vulnerability allows an attacker to compromise the integrity and confidentiality of the user session. Successful execution can result in the theft of sensitive authentication tokens, unauthorized manipulation of data presented to the user, or the execution of unauthorized actions on behalf of the victim. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to significant account takeover or data exposure within applications relying on Vega for visualization.

Immediate Action: Update the Vega library to version 5.6.3 or 6.1.2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor web application logs for unusual URL patterns or suspicious JSON inputs that deviate from standard visualization design schemas.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads in JSON inputs.

Public Exploit Available: Unknown.

Organizations utilizing the Vega library must prioritize updating to the patched versions, 5.6.3 or 6.1.2, to eliminate the risk of DOM-based XSS. Due to the high CVSS score and the existence of a proof-of-concept, this update should be treated as a high-priority remediation task to protect user sessions and sensitive data.