CVE-2025-66648highCWE-79

CVE-2025-66648: fallo de gravedad alta en vega

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear vega+ Monitorear vega.js

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 0.2%
vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
vega · vega
CVEs relacionadas — vega

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-26296HIGHXSS in VegaEPSS 1.7%CVE-2023-26487MEDIUMVega has cross-site scripting vulnerability in `lassoAppend` functionEPSS 0.8%CVE-2023-26486MEDIUMVega `scale` expression function cross site scriptingEPSS 0.8%CVE-2025-25304MEDIUMVega allows Cross-site Scripting via the vlSelectionTuples functionEPSS 0.7%CVE-2025-27793MEDIUMVega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]EPSS 0.5%CVE-2025-65110HIGHVega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scopeEPSS 0.5%