Vega vulnerable to arbitrary code execution when clicking href links

Description

Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.

Recommendation

Update the vega package to the latest compatible version. Followings are version details:

• Affected version(s): **< 4.5.1

  >= 5.0.0, < 5.4.1**

• Patched version(s): **4.5.1

  5.4.1**

References

• GHSA-cp47-r258-q626

Related Issues

• Vega allows Cross-site Scripting via the vlSelectionTuples function - CVE-2025-25304
• hemmelig allows SSRF Filter bypass via Secret Request functionality - CVE-2025-69206
• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - CVE-2025-59840
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571

Tags:

npm

vega