Executive brief
Vega is a JavaScript visualization library used to build interactive data visualizations. When a Vega application exposes Vega objects to the global window scope (a common debugging practice), attackers can craft malicious visualization specifications that execute arbitrary JavaScript code in the victim's browser. An attacker can exploit this by tricking a user into opening a malicious Vega visualization file, leading to theft of authentication tokens, data manipulation, or unauthorized actions.
Technical details
This is a DOM-based cross-site scripting (XSS) vulnerability in Vega that allows arbitrary code execution through expression evaluation. The root cause lies in the interaction between Vega's expression interpreter (which restricts direct function calls) and globally-exposed objects like VEGA_DEBUG. An attacker can craft a malicious Vega JSON specification containing a specially-crafted object that overrides the toString() method to invoke protected gadget functions (e.g., CanvasHandler.prototype.on) which ultimately call eval() with attacker-controlled code. Exploitation requires: (1) the Vega library and a View instance attached to the global window scope, and (2) the ability to supply a custom Vega JSON definition (e.g., via user upload or untrusted source). The vulnerability was patched in vega 6.2.0, vega-expression 6.1.0 (and 5.2.1 for non-ESM), and vega-interpreter 2.2.1.
Affected products
- Vega Vega <=6.1.2
- Vega vega-expression <=6.0.0; <=5.2.0
- Vega vega-interpreter <=2.2.0; <=1.2.0
Timeline
- 2025-11-13: disclosed: Vulnerability disclosed via GHSA-7f2v-3qq3-vvjf
- 2025-11-13: patched: Patches released: vega 6.2.0, vega-expression 6.1.0/5.2.1, vega-interpreter 2.2.1/1.2.1