Skip to content
OpenAdvisories

Package · npm

vega-selections

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.1
    CVE-2025-65110

    Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if "safe…

    vega vega vega.js vega.js Debian Ubuntu npm
  • Medium 6.9
    CVE-2025-25304

    Vega allows Cross-site Scripting via the vlSelectionTuples function

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions,…

    vega vega vega.js vega Debian Ubuntu npm