npm/vega CVE-2025-27793: medium 5.3, EPSS 0.52%
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Action: Upgrade vega to 5.32.0 or later.
npm i vega@5.32.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.32.0 | - |
Fixed versions
| 5.32.0 |
Sources
- osv: GHSA-963h-3v39-3pqf
- nvd: CVE-2025-27793
- https://github.com/vega/vega/security/advisories/GHSA-963h-3v39-3pqf
- https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966
- https://github.com/vega/vega
- https://github.com/vega/vega/releases/tag/v5.32.0
- https://vega.github.io/vega/usage/interpreter
CVE-2025-27793 · published · modified · JSON