CVE-2025-27793: Vega cross-site scripting via RegExp.prototype[@@replace]

CVE-2025-27793 · Severity: medium · CVSS 4 · Published 2025-03-27

Vega is a popular JavaScript visualization library used to render interactive graphs and charts from JSON specifications. A cross-site scripting vulnerability in Vega allows attackers to execute arbitrary JavaScript code when a user views a malicious Vega definition, potentially leading to session hijacking, credential theft, or malware distribution. This vulnerability affects applications that use Vega unless they use the vega-interpreter option.

Technologies: vega (npm), vega-functions (npm). Vendors: npm.

Quick answers

Is CVE-2025-27793 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-27793 being exploited in the wild.
How severe is CVE-2025-27793?
Medium severity, with a CVSS score of 4, published 27 March 2025.
Which products and versions are affected?
vega (npm) SEMVER:introduced=0,fixed=5.32.0; vega-functions (npm) SEMVER:introduced=0,fixed=5.17.0.
Is there a fix for CVE-2025-27793?
Yes. vega (npm): upgrade to 5.32.0 or later; vega-functions (npm): upgrade to 5.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-27793 attacked?
It is attacked over the network.
Am I affected by CVE-2025-27793?
Check whether you run vega (npm) or vega-functions (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vega (npm): upgrade to 5.32.0 or later
    npm install vega@5.32.0
  • vega-functions (npm): upgrade to 5.17.0 or later
    npm install vega-functions@5.17.0

Technical details

The vulnerability is a cross-site scripting (CWE-79, CWE-87) flaw in Vega's handling of the replace() function when processing Vega/Vega-Lite JSON specifications. The vulnerable code fails to sanitize the second argument to replace(), allowing an attacker to craft a RegExp-like object with a malicious exec function via prototype pollution. When replace() is called with this object, it invokes RegExp.prototype[@@replace], which calls the attacker-controlled exec function. An attacker can escalate this to arbitrary code execution by leveraging event.view.eval to execute JavaScript. The vulnerability is present in Vega versions prior to 5.32.0 and vega-functions versions prior to 5.17.0. The attack requires user interaction (viewing the malicious Vega definition) and network accessibility to deliver the payload, but no authentication is required. The workaround is to use Vega with the vega-interpreter option.

Affected products

  • Vega Vega prior to 5.32.0
  • Vega vega-functions prior to 5.17.0

Identifiers

  • CVE-2025-27793
  • GHSA-963h-3v39-3pqf

Timeline

  • 2025-03-27: disclosed: Vulnerability published by Vega security advisory and assigned CVE-2025-27793
  • 2025-03-27: patched: Vega 5.32.0 and vega-functions 5.17.0 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.