Log in Start free

Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2025-66648`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

High 7.2

In plain English

A high-severity cross-site scripting in vega from vega. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vega.jsno fix listedDEBIAN-CVE-2025-66648
Debian:13vega.jsno fix listedDEBIAN-CVE-2025-66648
Debian:14vega.js5.33.1+ds+~cs5.3.0-2DEBIAN-CVE-2025-66648
Ubuntu:24.04:LTSvega.jsno fix listedUBUNTU-CVE-2025-66648
Ubuntu:25.10vega.jsno fix listedUBUNTU-CVE-2025-66648
Ubuntu:26.04:LTSvega.jsno fix listedUBUNTU-CVE-2025-66648
Ubuntu:26.10vega.jsno fix listedUBUNTU-CVE-2025-66648
npmvega-functions6.1.1GHSA-m9rg-mr6g-75gm

Affected products (as reported)

VendorProductVersions
vega vega < 6.1.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References