CVE-2025-26619: Vega Cross-Site Scripting via event filter in expression interpreter

CVE-2025-26619 · Severity: low · CVSS 3.1 · Published 2025-03-27

Vega is a popular declarative language for creating interactive visualizations. A Cross-Site Scripting (XSS) vulnerability in the event filter mechanism allows attackers to inject and execute arbitrary JavaScript when users interact with visualizations, potentially stealing data or session credentials. This affects versions that do not use Content Security Policy (CSP) safe mode, which is not the default configuration.

Technologies: vega (npm), vega-functions (npm). Vendors: npm.

Quick answers

Is CVE-2025-26619 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-26619 being exploited in the wild.
How severe is CVE-2025-26619?
Low severity, with a CVSS score of 3.1, published 27 March 2025.
Which products and versions are affected?
vega (npm) SEMVER:introduced=0,fixed=5.31.0; vega-functions (npm) SEMVER:introduced=0,fixed=5.16.0.
Is there a fix for CVE-2025-26619?
Yes. vega (npm): upgrade to 5.31.0 or later; vega-functions (npm): upgrade to 5.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-26619 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-26619?
Check whether you run vega (npm) or vega-functions (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vega (npm): upgrade to 5.31.0 or later
    npm install vega@5.31.0
  • vega-functions (npm): upgrade to 5.16.0 or later
    npm install vega-functions@5.16.0

Technical details

The vulnerability is a Cross-Site Scripting (CWE-79) flaw in Vega's event filter mechanism when not using CSP mode expression interpreter. The root cause is insufficient input sanitization in the expression language parser, which allows attackers to call JavaScript functions that were not meant to be supported through crafted event filters. An attacker can inject malicious code via the "filter" parameter in event handlers (e.g., mousedown), which executes arbitrary JavaScript in the victim's browser when they interact with the visualization. The attack requires user interaction (clicking on a mark) but no authentication. Patches are available in vega 5.31.0 and vega-functions 5.16.0; users can also mitigate by running vega without the expression interpreter or by using CSP safe mode.

Affected products

  • Vega Vega 5.30.0 and lower
  • Vega vega-functions 5.15.0 and lower

Identifiers

  • CVE-2025-26619
  • GHSA-rcw3-wmx7-cphr

Timeline

  • 2025-03-27: disclosed: Vulnerability published as GHSA-rcw3-wmx7-cphr and CVE-2025-26619
  • 2025-03-27: patched: Patched in vega 5.31.0 and vega-functions 5.16.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.