Description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.
Published: 2025-03-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-14832 Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Github GHSA Github GHSA GHSA-963h-3v39-3pqf Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
History

Thu, 27 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Mar 2025 14:15:00 +0000

Type Values Removed Values Added
Description Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.
Title Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Weaknesses CWE-79
CWE-87
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-03-27T15:17:18.354Z

Reserved: 2025-03-06T18:06:54.462Z

Link: CVE-2025-27793

cve-icon Vulnrichment

Updated: 2025-03-27T15:16:13.583Z

cve-icon NVD

Status : Deferred

Published: 2025-03-27T14:15:54.060

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-27793

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses