CVE-2025-66648

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:*

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) vega-functions proporciona implementaciones de funciones para el lenguaje de expresiones Vega. Antes de la versión 6.1.1, para sitios que permiten a los usuarios proporcionar entradas de usuario no confiables, el uso malicioso de una función interna (no parte de la API pública) podría utilizarse para ejecutar javascript no intencionado (XSS). Este problema se ha corregido en vega-functions '6.1.1'. No hay solución alternativa aparte de la actualización. El uso de 'vega.expressionInterpreter' como se describe en el modo seguro de CSP no evita este problema.

Information

Published : 2026-01-05 22:15

Updated : 2026-10-14 19:10

NVD link : CVE-2025-66648

Mitre link : CVE-2025-66648

CVE.ORG link : CVE-2025-66648

JSON object : View

Products Affected

vega-functions_project

vega-functions

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66648", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66648", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T15:40:01.643885Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vega", "product": "vega", "versions": [{"status": "affected", "version": "< 6.1.1"}]}]}], "published": "2026-01-05T22:15:51.400", "references": [{"url": "https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue."}, {"lang": "es", "value": "vega-functions proporciona implementaciones de funciones para el lenguaje de expresiones Vega. Antes de la versi\u00f3n 6.1.1, para sitios que permiten a los usuarios proporcionar entradas de usuario no confiables, el uso malicioso de una funci\u00f3n interna (no parte de la API p\u00fablica) podr\u00eda utilizarse para ejecutar javascript no intencionado (XSS). Este problema se ha corregido en vega-functions '6.1.1'. No hay soluci\u00f3n alternativa aparte de la actualizaci\u00f3n. El uso de 'vega.expressionInterpreter' como se describe en el modo seguro de CSP no evita este problema."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vega-functions_project:vega-functions:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FED9629A-DA28-4F2E-8E62-E895759E77A0", "versionEndExcluding": "6.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}