Is CVE-2025-25304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-25304 being exploited in the wild.

How severe is CVE-2025-25304?

Medium severity, with a CVSS score of 4, published 14 February 2025.

Which products and versions are affected?

vega (npm) SEMVER:introduced=0,fixed=5.26.0; vega-selections (npm) SEMVER:introduced=0,fixed=5.4.2.

Is there a fix for CVE-2025-25304?

Yes. vega (npm): upgrade to 5.26.0 or later; vega-selections (npm): upgrade to 5.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-25304 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-25304?

Check whether you run vega (npm) or vega-selections (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-25304: Vega cross-site scripting in vlSelectionTuples function

CVE-2025-25304 · Severity: medium · CVSS 4 · Published 2025-02-14

Vega is a JavaScript visualization library used to create interactive data visualizations on web pages. A cross-site scripting (XSS) vulnerability in the vlSelectionTuples function allows attackers to inject and execute arbitrary JavaScript code through malicious Vega specifications, potentially compromising user sessions and stealing sensitive data from viewers of affected visualizations.

Technologies: vega (npm). Vendors: npm.

Quick answers

Is CVE-2025-25304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-25304 being exploited in the wild.
How severe is CVE-2025-25304?: Medium severity, with a CVSS score of 4, published 14 February 2025.
Which products and versions are affected?: vega (npm) SEMVER:introduced=0,fixed=5.26.0; vega-selections (npm) SEMVER:introduced=0,fixed=5.4.2.
Is there a fix for CVE-2025-25304?: Yes. vega (npm): upgrade to 5.26.0 or later; vega-selections (npm): upgrade to 5.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-25304 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-25304?: Check whether you run vega (npm) or vega-selections (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vega (npm): upgrade to 5.26.0 or later
```
npm install vega@5.26.0
```
vega-selections (npm): upgrade to 5.4.2 or later
```
npm install vega-selections@5.4.2
```

Technical details

The vlSelectionTuples function in Vega fails to properly sanitize attacker-controlled arguments passed to it, allowing an attacker to call the Function() constructor with arbitrary JavaScript code. The vulnerability exists in how the function processes the 'getter' parameter; an attacker can pass an array's constructor method (e.g., [].at.constructor) to gain access to the Function constructor and execute arbitrary code. This can be exploited by embedding a malicious Vega specification (JSON schema) with a crafted 'signals' section that triggers the XSS payload. No authentication is required—any user viewing a page embedding a malicious Vega visualization is at risk. The vulnerability has been patched in Vega v5.26.0 and vega-selections v5.4.2.

Affected products

Vega Vega < 5.26.0
Vega vega-selections < 5.4.2

Identifiers

CVE-2025-25304
GHSA-mp7w-mhcv-673j

Timeline

2025-02-14: disclosed: GHSA-mp7w-mhcv-673j published
2025-02-14: patched: Vega v5.26.0 and vega-selections v5.4.2 released

References

https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.