CVE-2025-65110

{"id": "CVE-2025-65110", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65110", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T21:39:12.943538Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vega", "product": "vega", "versions": [{"status": "affected", "version": "< 5.6.3"}, {"status": "affected", "version": ">= 6.0.0, < 6.1.2"}]}]}], "published": "2026-01-05T22:15:51.070", "references": [{"url": "https://github.com/vega/vega/security/advisories/GHSA-829q-m3qg-ph8r", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vega/vega/security/advisories/GHSA-829q-m3qg-ph8r", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if \"safe mode\" expressionInterpreter is used. First, they use `vega` in an application that attaches both `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window`, or has any other satisfactory function gadgets in the global scope. Second, they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). This vulnerability allows for DOM XSS, potentially stored, potentially reflected, depending on how the library is being used. The vulnerability requires user interaction with the page to trigger. An attacker can exploit this issue by tricking a user into opening a malicious Vega specification. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the application\u2019s domain. This can lead to theft of sensitive information such as authentication tokens, manipulation of data displayed to the user, or execution of unauthorized actions on behalf of the victim. This exploit compromises confidentiality and integrity of impacted applications.Patched versions are available in `vega-selections@6.1.2` (requires ESM) for Vega v6 and `vega-selections@5.6.3` (no ESM needed) for Vega v5. As a workaround, do not attach `vega` or `vega.View` instances to global variables or the window as the editor used to do. This is a development-only debugging practice that should not be used in any situation where Vega/Vega-lite definitions can come from untrusted parties."}, {"lang": "es", "value": "Vega es una gram\u00e1tica de visualizaci\u00f3n, un formato declarativo para crear, guardar y compartir dise\u00f1os de visualizaci\u00f3n interactivos. Antes de las versiones 6.1.2 y 5.6.3, las aplicaciones que cumplen dos condiciones est\u00e1n en riesgo de ejecuci\u00f3n arbitraria de c\u00f3digo JavaScript, incluso si se utiliza el expressionInterpreter en 'modo seguro'. Primero, utilizan 'vega' en una aplicaci\u00f3n que adjunta tanto la biblioteca 'vega' como una instancia de 'vega.View' similar al Editor de Vega a la 'window' global, o tiene cualquier otro gadget de funci\u00f3n satisfactorio en el \u00e1mbito global. Segundo, permiten definiciones 'JSON' de Vega definidas por el usuario (frente a JSON que solo se proporciona a trav\u00e9s del c\u00f3digo fuente). Esta vulnerabilidad permite XSS DOM, potencialmente almacenado, potencialmente reflejado, dependiendo de c\u00f3mo se est\u00e9 utilizando la biblioteca. La vulnerabilidad requiere interacci\u00f3n del usuario con la p\u00e1gina para activarse. Un atacante puede explotar este problema enga\u00f1ando a un usuario para que abra una especificaci\u00f3n Vega maliciosa. La explotaci\u00f3n exitosa permite al atacante ejecutar JavaScript arbitrario en el contexto del dominio de la aplicaci\u00f3n. Esto puede llevar al robo de informaci\u00f3n sensible como tokens de autenticaci\u00f3n, manipulaci\u00f3n de datos mostrados al usuario, o ejecuci\u00f3n de acciones no autorizadas en nombre de la v\u00edctima. Este exploit compromete la confidencialidad e integridad de las aplicaciones afectadas. Las versiones parcheadas est\u00e1n disponibles en 'vega-selections@6.1.2' (requiere ESM) para Vega v6 y 'vega-selections@5.6.3' (no se necesita ESM) para Vega v5. Como soluci\u00f3n alternativa, no adjunte instancias de 'vega' o 'vega.View' a variables globales o a la window como sol\u00eda hacer el editor. Esta es una pr\u00e1ctica de depuraci\u00f3n solo para desarrollo que no debe usarse en ninguna situaci\u00f3n donde las definiciones de Vega/Vega-lite puedan provenir de partes no confiables."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "778B8B8F-41D0-46F9-AF71-9C9E8735E289", "versionEndExcluding": "5.6.3"}, {"criteria": "cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "143E3DA8-3195-4BA7-A2ED-1DD049951E58", "versionEndExcluding": "6.1.2", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}