High, CVSS 8.1npmAmendedPublished
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
CVE-2025-59840 · GHSA-7f2v-3qq3-vvjf
- Affected
- npm vega-expression >= 6.0.0, < 6.1.0; < 5.2.1
- Fixed in
- 5.2.16.1.0· Vendor fix available
- Issue
- Impact Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. 1. Use vega in an application that attaches vega library and a vega.View instance similar to the Vega Editor to the global window 2. Allow user-defined Vega JSON definitions (vs JSON that was is only provided through source code) Patches - If using latest Vega line (6.x) - vega 6.2.0 / vega-expression 6.1.0 / vega-interpreter 2.2.1 (if using AST evaluator mode) - If using Vega in a non-ESM environment - ( vega-expression 5.2.1 / 1.2.1 (if using AST evaluator mode) Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading - Do not attach vega View instances to global variables, as Vega editor used to do here - Do not attach vega to the global window as the editor used to do here These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in…
Recommended action: Upgrade to 6.1.0 or 5.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.