Vega allows Cross-site Scripting via the vlSelectionTuples function (GHSA-mp7w-mhcv-673j)

Description

The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.

Recommendation

Update the vega-selections package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.4.2
• Patched version(s): 5.4.2

References

• GHSA-mp7w-mhcv-673j
• CVE-2025-25304
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
• Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter (GHSA-rcw3-wmx7-cphr) - CVE-2025-26619
• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia (GHSA-7f2v-3qq3-vvjf) - CVE-2025-59840
• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648

Tags:

npm

vega-selections