Executive brief
Vega is a popular JavaScript visualization library used to render interactive graphs and charts from JSON specifications. A cross-site scripting vulnerability in Vega allows attackers to execute arbitrary JavaScript code when a user views a malicious Vega definition, potentially leading to session hijacking, credential theft, or malware distribution. This vulnerability affects applications that use Vega unless they use the vega-interpreter option.
Technical details
The vulnerability is a cross-site scripting (CWE-79, CWE-87) flaw in Vega's handling of the replace() function when processing Vega/Vega-Lite JSON specifications. The vulnerable code fails to sanitize the second argument to replace(), allowing an attacker to craft a RegExp-like object with a malicious exec function via prototype pollution. When replace() is called with this object, it invokes RegExp.prototype[@@replace], which calls the attacker-controlled exec function. An attacker can escalate this to arbitrary code execution by leveraging event.view.eval to execute JavaScript. The vulnerability is present in Vega versions prior to 5.32.0 and vega-functions versions prior to 5.17.0. The attack requires user interaction (viewing the malicious Vega definition) and network accessibility to deliver the payload, but no authentication is required. The workaround is to use Vega with the vega-interpreter option.
Affected products
- Vega Vega prior to 5.32.0
- Vega vega-functions prior to 5.17.0
Timeline
- 2025-03-27: disclosed: Vulnerability published by Vega security advisory and assigned CVE-2025-27793
- 2025-03-27: patched: Vega 5.32.0 and vega-functions 5.17.0 released with fixes