CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function
Attackers can execute arbitrary JavaScript via the vlSelectionTuples function in Vega, potentially compromising user sessions or data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25304?
CVE-2025-25304 is a medium-severity cross-site scripting vulnerability in vega, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-25304?
4 open source packages ship an affected version, including vega and vega-selections.
| Package | Affected | Fixed in |
|---|---|---|
vega npm | All versions | 5.26.0 |
vega npm | All versions | 5.26.0 |
vega-selections npm | All versions | 5.4.2 |
vega-selections npm | All versions | 5.4.2 |
How do I fix CVE-2025-25304?
Upgrade vega to 5.26.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-25304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25304 exists.
Sources
Also known as DEBIAN-CVE-2025-25304, GHSA-mp7w-mhcv-673j, UBUNTU-CVE-2025-25304.