What is CVE-2025-66648?

CVE-2025-66648 is a high-severity vulnerability in Vega, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-01-05.

How severe is CVE-2025-66648?

High severity. CVSS v3 base score is 7.2 out of 10.

XSS in Vega

CVE-2025-66648

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (8.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Vega — versions < 6.1.1
Vega-functions_project Vega-functions

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-66648?: CVE-2025-66648 is a high-severity vulnerability in Vega, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-01-05.
How severe is CVE-2025-66648?: High severity. CVSS v3 base score is 7.2 out of 10.