Vega allows Cross-site Scripting via the vlSelectionTuples function - vega-selections
- Severity:
- Medium
Description
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
Recommendation
Update the vega-selections package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.4.2
- Patched version(s): 5.4.2
References
Related Issues
- Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
- `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
- Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega - CVE-2025-26619
- Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - CVE-2025-26619
You might also like:
- Tags:
- npm
- vega-selections
Anything's wrong? Let us know Last updated on February 14, 2025