npm/vega-selections CVE-2025-25304: medium 6.9, EPSS 0.65%
Vega allows Cross-site Scripting via the vlSelectionTuples function
Action: Upgrade vega-selections to 5.4.2 or later.
npm i vega-selections@5.4.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.4.2 | - |
Fixed versions
| 5.4.2 |
Sources
- osv: GHSA-mp7w-mhcv-673j#npm/vega-selections
- nvd: CVE-2025-25304
- https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j
- https://github.com/vega/vega/commit/9fb9ea07e27984394e463d286eb73944fa61411e
- https://github.com/vega/vega
- https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14
CVE-2025-25304 · published · modified · JSON