Vulnerability · Published Feb 14, 2025 · Assigned by GitHub_M

CVE-2025-25304Vega allows Cross-site Scripting via the vlSelectionTuples function

Medium 6.9

In plain English

A medium-severity cross-site scripting in vega from vega. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.7%top 48.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	vega.js	no fix listed	DEBIAN-CVE-2025-25304
Debian:13	vega.js	5.28.0+ds+~cs5.3.0-1	DEBIAN-CVE-2025-25304
Debian:14	vega.js	5.28.0+ds+~cs5.3.0-1	DEBIAN-CVE-2025-25304
Ubuntu:24.04:LTS	vega.js	no fix listed	UBUNTU-CVE-2025-25304
Ubuntu:25.10	vega.js	no fix listed	UBUNTU-CVE-2025-25304
Ubuntu:26.04:LTS	vega.js	no fix listed	UBUNTU-CVE-2025-25304
Ubuntu:26.10	vega.js	no fix listed	UBUNTU-CVE-2025-25304
npm	vega	5.26.0	GHSA-mp7w-mhcv-673j
npm	vega-selections	5.4.2	GHSA-mp7w-mhcv-673j

Affected products (as reported)

Vendor	Product	Versions
vega	vega	< 5.26.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j x_refsource_CONFIRM
https://github.com/vega/vega/commit/9fb9ea07e27984394e463d286eb73944fa61411e x_refsource_MISC
https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14 x_refsource_MISC