{"action":"Upgrade vega to 5.26.0 or later.","affected":[{"fixed":"5.26.0","introduced":"0"}],"component":"vega","cve_ids":["CVE-2025-25304"],"ecosystem":"npm","epss":0.00651,"exploited":false,"fixed_versions":["5.26.0"],"ghsa_id":"GHSA-mp7w-mhcv-673j","id":"tcs_01M5KG189P6W4CM04819RAJY69","modified_at":"2025-02-14T22:17:54Z","published_at":"2025-02-14T17:33:58Z","references":["https://osv.dev/vulnerability/GHSA-mp7w-mhcv-673j","https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j","https://nvd.nist.gov/vuln/detail/CVE-2025-25304","https://github.com/vega/vega/commit/9fb9ea07e27984394e463d286eb73944fa61411e","https://github.com/vega/vega","https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-mp7w-mhcv-673j","url":"https://osv.dev/vulnerability/GHSA-mp7w-mhcv-673j"},{"source":"nvd","source_id":"CVE-2025-25304","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25304"}],"summary":"Vega allows Cross-site Scripting via the vlSelectionTuples function"}