Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

vega-selections

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1npmAmendedPublished

    Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

    CVE-2025-65110 · GHSA-829q-m3qg-ph8r

    Affected
    • npm vega-selections < 5.6.3; >= 6.0.0, < 6.1.2
    Fixed in
    5.6.36.1.2· Vendor fix available
    Issue
    Impact Applications meeting these two conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. 1. Use vega in an application that attaches both vega library and a vega.View instance similar to the Vega Editor to the global window, or has any other satisfactory function gadgets in the global scope 2. Allow user-defined Vega JSON definitions (vs JSON that was is only provided through source code) Patches - With Vega v6, use vega-selections@6.1.2 (requires ESM) - With Vega v5, use vega-selections@5.6.3 (No ESM needed) Workarounds - Do not attach vega or vega.View instances to global variables or the window as the editor used to do here . This is a development-only debugging practice that should not be used in any situation where Vega/Vega-lite definitions can come from untrusted parties. POC Summary Vega offers the evaluation of expressions in a secure context. Arbitrary function call is prohibited. When an event is exposed to an…

    Recommended action: Upgrade to 6.1.2 or 5.6.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 6.9npmAmendedPublished

    Vega allows Cross-site Scripting via the vlSelectionTuples function

    CVE-2025-25304 · GHSA-mp7w-mhcv-673j

    Affected
    • npm vega-selections < 5.4.2
    Fixed in
    5.4.2· Vendor fix available
    Issue
    The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS. Details vlSelectionTuples calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. Example call: vlSelectionTuples([{datum:<argument}], {fields:[{getter:<function}]}) This can be used to call Function() with arbitrary JavaScript and the resulting function can be called with vlSelectionTuples or using a type coercion to call toString or valueOf. PoC

    Recommended action: Upgrade to 5.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →