vega vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20232
3. 20254
4. 20262

Newest CVEs

• CVE-2025-66648

  `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

  vega · vega

  High7.2
• CVE-2025-65110

  Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

  vega · vega

  High8.1
• CVE-2025-59840

  Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

  vega · vega

  High8.1
• CVE-2025-27793

  Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

  vega · vega

  Medium5.3
• CVE-2025-26619

  Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

  vega · vega

  Medium5.3
• CVE-2025-25304

  Vega allows Cross-site Scripting via the vlSelectionTuples function

  vega · vega

  Medium6.9
• CVE-2023-26486

  Vega `scale` expression function cross site scripting

  vega · vega

  Medium6.5
• CVE-2023-26487

  Vega has cross-site scripting vulnerability in `lassoAppend` function

  vega · vega

  Medium6.5
• CVE-2020-26296

  XSS in Vega

  vega · vega

  High8.7