Is CVE-2025-66648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66648 being exploited in the wild.

How severe is CVE-2025-66648?

High severity, with a CVSS score of 7.2, published 5 January 2026.

Which products and versions are affected?

vega-functions (npm) SEMVER:introduced=0,fixed=6.1.1.

Is there a fix for CVE-2025-66648?

Yes. vega-functions (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66648 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66648?

Check whether you run vega-functions (npm) or Vega-Functions Project Vega-Functions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66648: Vega vega-functions cross-site scripting in setdata function

CVE-2025-66648 · Severity: high · CVSS 7.2 · Published 2026-01-05

Vega-functions is a JavaScript library used to build interactive data visualizations. A cross-site scripting (XSS) vulnerability in the setdata function allows attackers to inject and execute arbitrary JavaScript code when users supply untrusted input to visualizations. This can result in session hijacking, credential theft, or malware distribution through compromised charts and dashboards.

Technologies: vega-functions (npm). Vendors: npm.

Quick answers

Is CVE-2025-66648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66648 being exploited in the wild.
How severe is CVE-2025-66648?: High severity, with a CVSS score of 7.2, published 5 January 2026.
Which products and versions are affected?: vega-functions (npm) SEMVER:introduced=0,fixed=6.1.1.
Is there a fix for CVE-2025-66648?: Yes. vega-functions (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66648 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66648?: Check whether you run vega-functions (npm) or Vega-Functions Project Vega-Functions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vega-functions (npm): upgrade to 6.1.1 or later
```
npm install vega-functions@6.1.1
```

Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in vega-functions' internal setdata function, which uses the modify() expression method. The modify() function allows attackers to control both the method being invoked and the values supplied to it, enabling arbitrary JavaScript execution. No authentication or user interaction is required; the attack succeeds when untrusted user input is processed in a Vega specification. The vulnerability affects all versions through 6.1.0 and is fixed in 6.1.1. Standard Content Security Policy mitigations do not prevent this attack.

Affected products

Vega vega-functions through 6.1.0

Identifiers

CVE-2025-66648
GHSA-m9rg-mr6g-75gm

Timeline

2026-01-05: disclosed
2026-01-05: patched: Fixed in vega-functions 6.1.1

References

https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.