Vulnerability · Published Mar 27, 2025 · Assigned by GitHub_M
CVE-2025-26619Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`
Medium 5.3
In plain English
A medium-severity cross-site scripting in vega from vega. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | vega.js | no fix listed | DEBIAN-CVE-2025-26619 |
| Debian:13 | vega.js | no fix listed | DEBIAN-CVE-2025-26619 |
| Debian:14 | vega.js | 5.33.1+ds+~cs5.3.0-1 | DEBIAN-CVE-2025-26619 |
| Ubuntu:24.04:LTS | vega.js | no fix listed | UBUNTU-CVE-2025-26619 |
| Ubuntu:25.10 | vega.js | no fix listed | UBUNTU-CVE-2025-26619 |
| Ubuntu:26.04:LTS | vega.js | no fix listed | UBUNTU-CVE-2025-26619 |
| Ubuntu:26.10 | vega.js | no fix listed | UBUNTU-CVE-2025-26619 |
| npm | vega | 5.31.0 | GHSA-rcw3-wmx7-cphr |
| npm | vega-functions | 5.16.0 | GHSA-rcw3-wmx7-cphr |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/vega/vega/security/advisories/GHSA-rcw3-wmx7-cphr x_refsource_CONFIRM
- https://github.com/vega/vega-lite/issues/9469 x_refsource_MISC
- https://github.com/vega/vega/issues/3984 x_refsource_MISC
- https://github.com/vega/vega/commit/8fc129a6f8a11e96449c4ac0f63de0e5bfc7254c x_refsource_MISC