Read the docs

Vega Project

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Vega Project records in CISA KEV

No Vega Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vega 6 records HIGH

Records

6 records in Vega · all components

TI-2025-40262 CVE-2025-65110 · GHSA-829q-m3qg-ph8r

Cross-site scripting in vega

Priority HIGH 75

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00504 Published 2026-01-05 Fixed in 5.6.3, 6.1.2 CWE-79
TI-2020-16117 CVE-2020-26296 · GHSA-r2qc-w64x-6j54

Cross-site scripting in vega

Priority MEDIUM 41

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01713 Published 2020-12-30 Partial fix · 5.17.3 CWE-79
TI-2023-11634 CVE-2023-26487 · GHSA-w5m3-xh75-mp55

Vega has cross-site scripting vulnerability in `lassoAppend` function

Priority LOW 36

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argum…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00806 Published 2023-03-03 Partial fix · 5.23.0, 5.13.1 CWE-79
TI-2023-11633 CVE-2023-26486 · GHSA-4vq7-882g-wcg4

Vega `scale` expression function cross site scripting

Priority LOW 36

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00775 Published 2023-03-03 Partial fix · 5.13.1, 5.23.0 CWE-79
TI-2019-08071 CVE-2019-10806 · GHSA-6hwh-rqwf-cxxr

Prototype pollution in vega-util

Priority LOW 22

vega-util prior to 1.13.1 allows manipulation of object prototype.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01109 Published 2020-03-09 Fixed in 1.13.1 CWE-1321
Open these records in search →