CVE-2025-27793
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.
Reserved 2025-03-06 | Published 2025-03-27 | Updated 2025-03-27 | Assigner GitHub_MCWE-87: Improper Neutralization of Alternate XSS Syntax
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
github.com/vega/vega/security/advisories/GHSA-963h-3v39-3pqf
github.com/...ommit/694560c0aa576df8b6c5f0f7d202ac82233e6966
github.com/vega/vega/releases/tag/v5.32.0
vega.github.io/vega/usage/interpreter
Support options
