Skip to main content

Vega Functions

4 CVEs product

Monthly

CVE-2025-66648 Jan 05, 22:15 npm HIGH POC PATCH This Week

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). [CVSS 7.2 HIGH]

XSS Red Hat Vega Functions Vega Functions Project
NVD GitHub
CVSS 3.1
7.2
EPSS
0.0%
CVE-2025-26619 Mar 27, 14:15 npm MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Vega Vega Functions Vega Project Vega Functions Project
NVD GitHub
CVSS 4.0
5.3
EPSS
0.2%
CVE-2023-26487 Mar 04, 00:15 npm MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push`. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Vega Vega Functions Vega Project Vega Functions Project
NVD GitHub
CVSS 3.1
6.1
EPSS
0.8%
CVE-2023-26486 Mar 04, 00:15 npm MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Vega Vega Functions Vega Project Vega Functions Project
NVD GitHub
CVSS 3.1
6.1
EPSS
0.8%
EPSS 0% CVSS 7.2
HIGH POC PATCH This Week

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). [CVSS 7.2 HIGH]

XSS Red Hat Vega Functions +1
NVD GitHub
EPSS 0% CVSS 5.3
MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Vega Vega Functions +2
NVD GitHub
EPSS 1% CVSS 6.1
MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push`. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS Vega Vega Functions +2
NVD GitHub
EPSS 1% CVSS 6.1
MEDIUM POC PATCH This Month

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Vega Vega Functions +2
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy