microsoft / microsoft/fluentui
[Bug]: @fluentui/react-charts - VegaDeclarativeChart - Sandbox escape enables arbitrary JavaScript execution
Open
@AtishayMsft is already working on this.
Since Sep 7, 2026.
Needs: Attention
Package: charting
Type: Bug :bug:
- Dominant language
- TypeScript
- Stars
- 20.3k
- Forks
- 2.9k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 46
Description
Charting Control
Other...
Package version
NA
React version
NA
Environment
NA
Current Behavior
@fluentui/react-charts - VegaDeclarativeChart - Sandbox escape enables arbitrary JavaScript execution
Expected Behavior
NA
Reproduction
NA
Steps to reproduce
Details in IcM
Are you reporting an Accessibility issue?
None
Suggested severity
Urgent - No workaround and Products/sites are affected
Products/sites affected
No response
Are you willing to submit a PR to fix?
yes
Validations
- Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
- The provided reproduction is a minimal reproducible example of the bug.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.