Skip to content
OpenAdvisories

Package · Debian

vega.js

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2025-66648

    `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

    vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unint…

    vega vega jupyter-base-notebook py3.11-jupyterlab Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2025-65110

    Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if "safe…

    vega vega vega.js vega.js Debian Ubuntu npm
  • High 8.1
    CVE-2025-59840

    Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode…

    vega vega jupyter-base-notebook py3.12-jupyterlab Debian Ubuntu Wolfi npm