p PatchFirst

CVE-2025-66648

CVE-2025-66648 · `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

CVSS 7.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • vega

    Versions
    • < 6.1.1: Affected

    No fix published

  • vega.js Debian:12

    Versions
    • 5.22.1+ds+~3.1.0-4
    • 5.25.0+ds+~cs5.3.0-1
    • 5.25.0+ds+~cs5.3.0-2
    • 5.25.0+ds+~cs5.3.0-3
    • 5.25.0+ds+~cs5.3.0-4
    • 5.25.0+ds+~cs5.3.0-5
    • 5.28.0+ds+~cs5.3.0-1
    • 5.28.0+ds+~cs5.3.0-2
    • 5.28.0+ds+~cs5.3.0-3
    • 5.33.1+ds+~cs5.3.0-1
    • 5.33.1+ds+~cs5.3.0-2
    • 5.33.1+ds+~cs5.3.0-3
    • 5.33.1+ds+~cs5.3.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vega.js Debian:13

    Versions
    • 5.28.0+ds+~cs5.3.0-1
    • 5.28.0+ds+~cs5.3.0-2
    • 5.28.0+ds+~cs5.3.0-3
    • 5.33.1+ds+~cs5.3.0-1
    • 5.33.1+ds+~cs5.3.0-2
    • 5.33.1+ds+~cs5.3.0-3
    • 5.33.1+ds+~cs5.3.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vega.js Debian:14

    Versions
    • 5.28.0+ds+~cs5.3.0-1
    • 5.28.0+ds+~cs5.3.0-2
    • 5.28.0+ds+~cs5.3.0-3
    • 5.33.1+ds+~cs5.3.0-1
    Affected ranges
    • ECOSYSTEM: < 5.33.1+ds+~cs5.3.0-2

    Update to 5.33.1+ds+~cs5.3.0-2

  • vega-functions npm

    Affected ranges
    • SEMVER: < 6.1.1

    Update to 6.1.1

  • vega.js Ubuntu:24.04:LTS

    Versions
    • 5.25.0+ds+~cs5.3.0-2
    • 5.25.0+ds+~cs5.3.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vega.js Ubuntu:25.10

    Versions
    • 5.28.0+ds+~cs5.3.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vega.js Ubuntu:26.10

    Versions
    • 5.28.0+ds+~cs5.3.0-2
    • 5.33.1+ds+~cs5.3.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vega.js Ubuntu:26.04:LTS

    Versions
    • 5.28.0+ds+~cs5.3.0-1
    • 5.28.0+ds+~cs5.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →