# CVE-2025-66648: Vega vega-functions cross-site scripting in setdata function

Source: https://junglewise.ai/threats/cve-2025-66648-vega-vega-functions-cross-site-scripting-in-setdata-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66648 · Severity: high · CVSS 7.2 · Published 2026-01-05

Vega-functions is a JavaScript library used to build interactive data visualizations. A cross-site scripting (XSS) vulnerability in the setdata function allows attackers to inject and execute arbitrary JavaScript code when users supply untrusted input to visualizations. This can result in session hijacking, credential theft, or malware distribution through compromised charts and dashboards.

Technologies: [vega-functions (npm)](https://junglewise.ai/threats/technologies/vega-functions). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-66648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66648 being exploited in the wild.

**How severe is CVE-2025-66648?** High severity, with a CVSS score of 7.2, published 5 January 2026.

**Which products and versions are affected?** vega-functions (npm) SEMVER:introduced=0,fixed=6.1.1.

**Is there a fix for CVE-2025-66648?** Yes. vega-functions (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66648 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66648?** Check whether you run vega-functions (npm) or Vega-Functions Project Vega-Functions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vega-functions (npm): upgrade to 6.1.1 or later

  ```sh
  npm install vega-functions@6.1.1
  ```


## Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in vega-functions' internal setdata function, which uses the modify() expression method. The modify() function allows attackers to control both the method being invoked and the values supplied to it, enabling arbitrary JavaScript execution. No authentication or user interaction is required; the attack succeeds when untrusted user input is processed in a Vega specification. The vulnerability affects all versions through 6.1.0 and is fixed in 6.1.1. Standard Content Security Policy mitigations do not prevent this attack.

## Affected products

- Vega vega-functions through 6.1.0

## Identifiers

- CVE-2025-66648
- GHSA-m9rg-mr6g-75gm

## Timeline

- 2026-01-05: disclosed
- 2026-01-05: patched: Fixed in vega-functions 6.1.1

## References

- [https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm](https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm)

## Related threats

- [Vega cross-site scripting via RegExp.prototype[@@replace]](https://junglewise.ai/threats/cve-2025-27793-vega-cross-site-scripting-via-regexp-prototype-replace)
- [Vega Cross-Site Scripting via event filter in expression interpreter](https://junglewise.ai/threats/cve-2025-26619-vega-cross-site-scripting-via-event-filter-in-expression)
- [Vega Expression Language scale function cross-site scripting](https://junglewise.ai/threats/cve-2023-26486-vega-expression-language-scale-function-cross-site-scripting)
- [Vega cross-site scripting in lassoAppend function](https://junglewise.ai/threats/cve-2023-26487-vega-cross-site-scripting-in-lassoappend-function)