Skip to content
OpenAdvisories

Package · npm

vega-expression

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.1
    CVE-2025-59840

    Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode…

    vega vega jupyter-base-notebook py3.11-jupyterlab Debian Ubuntu Wolfi npm