Skip to content
OpenAdvisories

Package · npm

vega-selections

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.9
    CVE-2025-25304

    Vega allows Cross-site Scripting via the vlSelectionTuples function

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions,…

    vega vega vega.js vega Debian Ubuntu npm