TI-2025-18958 Aliases CVE-2025-25304 GHSA-mp7w-mhcv-673j

Vega allows Cross-site Scripting via the vlSelectionTuples function

HIGH 70CWE-79Published 2025-02-14 · Updated 2025-02-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00651 51st percentileScored 2026-11-07

Fix Fixed vega (vega): 5.26.0vega (npm): 5.26.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vega	vega	before 5.26.0	5.26.0	Patch available	CNA
—	vega (npm)	before 5.26.0	5.26.0	Patch available	GHSA-mp7w-mhcv-673j
—	vega-selections (npm)	before 5.4.2	5.4.2	Patch available	GHSA-mp7w-mhcv-673j

vega Vendorvega Affected before 5.26.0 Fixed in 5.26.0 Patch available CNA
vega (npm) Vendor— Affected before 5.26.0 Fixed in 5.26.0 Patch available GHSA-mp7w-mhcv-673j
vega-selections (npm) Vendor— Affected before 5.4.2 Fixed in 5.4.2 Patch available GHSA-mp7w-mhcv-673j

Remediation

Fix · CNA vega (vega) Fixed in 5.26.0
Fix · GHSA-mp7w-mhcv-673j vega (npm) Fixed in 5.26.0 Advisory →
Fix · GHSA-mp7w-mhcv-673j vega-selections (npm) Fixed in 5.4.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-25304
2026-10-03 Alias added: GHSA-mp7w-mhcv-673j
2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-25304

Other 4

TI-2025-40262 Cross-site scripting in vega CVSS 3.1CRITICAL 9.3
TI-2025-37279 Cross-site scripting in vega CVSS 3.1HIGH 8.1
TI-2025-19556 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVSS 4.0MEDIUM 5.3
TI-2020-16117 Cross-site scripting in vega CVSS 3.1HIGH 8.7
TI-2026-02866 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVSS 3.1HIGH 7.5
TI-2025-41032 `vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVSS 3.1HIGH 7.2

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences