vega

npm · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variableCVE-2025-59840 · GHSA-7F2V-3QQ3-VVJF	vega-expression vega-interpreter	npmRed Hat	High	Fix reported	2026-09-10
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeterCVE-2025-26619 · GHSA-RCW3-WMX7-CPHR	vega-functions vega	npm	Medium	Fix reported	2026-09-10
Vega has Cross-site Scripting vulnerability in `lassoAppend` functionCVE-2023-26487 · GHSA-W5M3-XH75-MP55	vega-functions vega	npmRed Hat	Medium	Fix reported	2026-09-10
Vega Expression Language `scale` expression function Cross Site ScriptingCVE-2023-26486 · GHSA-4VQ7-882G-WCG4	vega-functions vega	npmRed Hat	Medium	Fix reported	2026-09-10
XSS in VegaCVE-2020-26296 · GHSA-R2QC-W64X-6J54	vega Red Hat OpenShift Container Platform 4/openshift4/ose-logging-kibana6	npmRed Hat	Low	Fix reported	2026-09-10
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]CVE-2025-27793 · GHSA-963H-3V39-3PQF	vega-functions vega	npm	Medium	Fix reported	2025-03-27
Vega allows Cross-site Scripting via the vlSelectionTuples functionCVE-2025-25304 · GHSA-MP7W-MHCV-673J	vega-selections vega	npm	Medium	Fix reported	2025-02-15
Vega vulnerable to arbitrary code execution when clicking href linksGHSA-CP47-R258-Q626	vega	npm	Medium	Fix reported	2023-03-03