Vega vulnerable to arbitrary code execution when clicking href links

Description

Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.

Recommendation

Update the vega package to the latest compatible version. Followings are version details:

• Affected version(s): **< 4.5.1

  >= 5.0.0, < 5.4.1**

• Patched version(s): **4.5.1

  5.4.1**

References

• GHSA-cp47-r258-q626

Related Issues

• Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

vega