Description
For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS).
Recommendation
Update the vega-functions package to the latest compatible version. Followings are version details:
- Affected version(s): <= 6.1.0
- Patched version(s): 6.1.1
References
Could your website be exposed too?
SmartScanner can check your website for `vega-functions` vulnerable to Cross-site Scripting via `setdata` function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793
- Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - CVE-2025-26619
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega - CVE-2025-27793
- Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
You might also like:
See something that needs correcting? Let us knowUpdated January 06, 2026