npm/vega-functions CVE-2025-26619: medium 6.1, EPSS 0.35%
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
Action: Upgrade vega-functions to 5.16.0 or later.
npm i vega-functions@5.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.16.0 | - |
Fixed versions
| 5.16.0 |
Sources
- osv: GHSA-rcw3-wmx7-cphr#npm/vega-functions
- https://github.com/vega/vega/security/advisories/GHSA-rcw3-wmx7-cphr
- https://nvd.nist.gov/vuln/detail/CVE-2025-26619
- https://github.com/vega/vega-lite/issues/9469
- https://github.com/vega/vega/issues/3984
- https://github.com/vega/vega/commit/8fc129a6f8a11e96449c4ac0f63de0e5bfc7254c
- https://github.com/vega/vega
CVE-2025-26619 · published · modified · JSON