Cross-site scripting in vega
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vega | vega | vega < 6.2.0; vega-expression >= 6.0.0, < 6.1.0; vega-expression < 5.2.1; vega-interpreter >= 2.0.0, < 2.2.1; vega-interpreter < 1.2.1 | — | No fix listed | CNA |
| — | vega (npm) | before 6.2.0 | 6.2.0 | Patch available | GHSA-7f2v-3qq3-vvjf |
| — | vega-expression (npm) | 6.0.0 to before 6.1.0 | 6.1.0 | Patch available | GHSA-7f2v-3qq3-vvjf |
| — | vega-interpreter (npm) | 2.0.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-7f2v-3qq3-vvjf |
| — | vega-interpreter (npm) | before 1.2.1 | 1.2.1 | Patch available | GHSA-7f2v-3qq3-vvjf |
| — | vega-expression (npm) | before 5.2.1 | 5.2.1 | Patch available | GHSA-7f2v-3qq3-vvjf |
- vega Vendorvega Affected vega < 6.2.0; vega-expression >= 6.0.0, < 6.1.0; vega-expression < 5.2.1; vega-interpreter >= 2.0.0, < 2.2.1; vega-interpreter < 1.2.1 Fixed in — No fix listed CNA
- vega (npm) Vendor— Affected before 6.2.0 Fixed in 6.2.0 Patch available GHSA-7f2v-3qq3-vvjf
- vega-expression (npm) Vendor— Affected 6.0.0 to before 6.1.0 Fixed in 6.1.0 Patch available GHSA-7f2v-3qq3-vvjf
- vega-interpreter (npm) Vendor— Affected 2.0.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-7f2v-3qq3-vvjf
- vega-interpreter (npm) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-7f2v-3qq3-vvjf
- vega-expression (npm) Vendor— Affected before 5.2.1 Fixed in 5.2.1 Patch available GHSA-7f2v-3qq3-vvjf
Remediation
- Fix · GHSA-7f2v-3qq3-vvjf vega (npm) Fixed in 6.2.0 Advisory →
- Fix · GHSA-7f2v-3qq3-vvjf vega-expression (npm) Fixed in 6.1.0 Advisory →
- Fix · GHSA-7f2v-3qq3-vvjf vega-interpreter (npm) Fixed in 2.2.1 Advisory →
- Fix · GHSA-7f2v-3qq3-vvjf vega-interpreter (npm) Fixed in 1.2.1 Advisory →
- Fix · GHSA-7f2v-3qq3-vvjf vega-expression (npm) Fixed in 5.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
Not affected: 1 product
- Logging Subsystem for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59840
- 2026-10-03 Alias added: GHSA-7f2v-3qq3-vvjf
References
Other 6
- https://github.com/vega/vega/security/advisories/GHSA-7f2v-3qq3-vvjf
- https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/components/renderer/renderer.tsx#L239
- https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/index.tsx#L14-L16
- https://github.com/vega/vega
- https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAB3GgBN6aAMwCADDPg0yWVRplIGmNhBoAvOGhDiJVmQrjQATjRyZ2k9ABU2ZMgA2cAAEAELGJpIyZmTiSAEQaADaoHEIVugm-kHSIMTxDBmYzoUyEsmgcKTimImooJgAnjgZIFABNFAA1rnIzl1prVA0zu1WAL4yDDgKSJitWYEhAPzBAGbxECGowcWFIOMAupOpSOnWSAoKAGI0AfPOueWoKSBVcDV1Dc2tCGwMWz+pFyYgYo1a8nECjYsgOUxmc1aAApgCYAMrFGjiMiod41SjEGhwWSUABqAFEAOIAQQA+gARcmhACqlIJfEoAGEkOJ8hAABI8hRBZyUHDONgmJotSgSKTBPGYAByZzguOqmAJRJJUAkYiClACfiktJgQpF+GADChcDWWLgClQAHJ4nBnJgkWxXLRxMEANTBAAGwQAGmi0cEJMFSM4zFHAwGKTSGUzWWSqXSKQAlNEASQA8kqAJROyam81u3M2gAe6o+msJxMoVXi4yLfoAjAdjscgA
- https://vega.github.io/vega/usage/interpreter
More vega vulnerabilities
- TI-2025-40262 Cross-site scripting in vega CVSS 3.1CRITICAL 9.3
- TI-2025-18958 Vega allows Cross-site Scripting via the vlSelectionTuples function CVSS 4.0MEDIUM 6.9
- TI-2025-19556 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVSS 4.0MEDIUM 5.3
- TI-2020-16117 Cross-site scripting in vega CVSS 3.1HIGH 8.7
- TI-2026-02866 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVSS 3.1HIGH 7.5
- TI-2025-41032 `vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVSS 3.1HIGH 7.2
Sources
- CVE-2025-59840 · CVE Program
- CVE-2025-59840 · NVD
- FIRST EPSS
- GHSA-7f2v-3qq3-vvjf · GitHub Advisory Database · CC BY 4.0
- CVE-2025-59840 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences