Read the docs
TI-2025-41032 Aliases CVE-2025-66648GHSA-m9rg-mr6g-75gm

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vega (vega): 6.1.1vega-functions (npm): 6.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vegavegabefore 6.1.16.1.1Patch availableCNA
—vega-functions (npm)before 6.1.16.1.1Patch availableGHSA-m9rg-mr6g-75gm
  • vega Vendorvega Affected before 6.1.1 Fixed in 6.1.1 Patch available CNA
  • vega-functions (npm) Vendor— Affected before 6.1.1 Fixed in 6.1.1 Patch available GHSA-m9rg-mr6g-75gm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:*before 6.1.1VulnerableVega-functions Project
  • cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:* Versions before 6.1.1 Vulnerable ·Vega-functions Project

Remediation

  • Fix · CNA vega (vega) Fixed in 6.1.1
  • Fix · GHSA-m9rg-mr6g-75gm vega-functions (npm) Fixed in 6.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66648
  2. 2026-10-03 Alias added: GHSA-m9rg-mr6g-75gm

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-40262 Cross-site scripting in vega CVSS 3.1CRITICAL 9.3
  • TI-2025-18958 Vega allows Cross-site Scripting via the vlSelectionTuples function CVSS 4.0MEDIUM 6.9
  • TI-2025-37279 Cross-site scripting in vega CVSS 3.1HIGH 8.1
  • TI-2025-19556 Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVSS 4.0MEDIUM 5.3
  • TI-2020-16117 Cross-site scripting in vega CVSS 3.1HIGH 8.7
  • TI-2026-02866 VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences