Skip to content
OpenAdvisories

Package · Ubuntu

vega.js

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-27793

    Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions …

    vega vega vega vega.js Debian Ubuntu npm
  • Medium 5.3
    CVE-2025-26619

    Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega express…

    vega vega vega vega.js Debian Ubuntu npm
  • Medium 6.9
    CVE-2025-25304

    Vega allows Cross-site Scripting via the vlSelectionTuples function

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions,…

    vega vega vega.js vega Debian Ubuntu npm