Vega allows Cross-site Scripting via the vlSelectionTuples function - vega-selections - CVE-2025-25304 | SmartScanner

Description

The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.

Recommendation

Update the vega-selections package to the latest compatible version. Followings are version details:

Affected version(s): < 5.4.2
Patched version(s): 5.4.2

References

GHSA-mp7w-mhcv-673j
CVE-2025-25304
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Vega allows Cross-site Scripting via the vlSelectionTuples function - vega-selections and gives you actionable findings to investigate.

Start a free scan

Related Issues

Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - CVE-2025-26619
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega - CVE-2025-26619

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 14, 2025