CVE-2025-14896
due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
due to insufficient sanitazation in Vega’s convert() function when safeMode is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com