npm/vega-functions CVE-2025-27793: medium 5.3, EPSS 0.52%
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Action: Upgrade vega-functions to 5.17.0 or later.
npm i vega-functions@5.17.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.17.0 | - |
Fixed versions
| 5.17.0 |
Sources
- osv: GHSA-963h-3v39-3pqf#npm/vega-functions
- nvd: CVE-2025-27793
- https://github.com/vega/vega/security/advisories/GHSA-963h-3v39-3pqf
- https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966
- https://github.com/vega/vega
- https://github.com/vega/vega/releases/tag/v5.32.0
- https://vega.github.io/vega/usage/interpreter
CVE-2025-27793 · published · modified · JSON