A critical cross-site scripting vulnerability in vega-functions allows unauthenticated attackers to execute arbitrary JavaScript, posing a significant risk of data theft and session hijacking.

This vulnerability involves an improper neutralization of input, specifically where an internal, non-public function is reachable by untrusted user input. This allows an unauthenticated attacker to bypass standard protections and execute arbitrary JavaScript code in the context of the user's browser.

The ability for an attacker to execute arbitrary scripts in a user's browser leads to potential session hijacking, unauthorized data access, and the performance of actions on behalf of the user. With a CVSS score of 7.2, this vulnerability represents a high risk to application integrity and user privacy. Failure to remediate could result in widespread account compromise or the injection of malicious content into legitimate web pages.

Immediate Action: Update the vega-functions package to version 6.1.1 or later to incorporate the vendor-provided fix.

Proactive Monitoring: Review web application logs for suspicious patterns, such as unusual URL parameters or payloads containing script tags, that may indicate attempted exploitation.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, although note that the vendor specifically stated CSP safe mode does not prevent this specific issue.

Public Exploit Available: Unknown

Given the ease of exploitability and the potential for severe impact on user security, organizations using the Vega expression language must prioritize upgrading to version 6.1.1. There are no effective workarounds for this flaw, making the software update the only viable path to full remediation.