XSS in Vega
CVE-2025-66648
vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (11.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 11.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Vega — versions < 6.1.1
- Vega-Functions Project
Weakness classification (CWE)
References
- github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-66648?
- CVE-2025-66648 is a high-severity vulnerability in Vega, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-01-05.
- How severe is CVE-2025-66648?
- High severity. CVSS v3 base score is 7.2 out of 10.