Fluid Attacks Database

Description

vega-functions vulnerable to Cross-site Scripting via setdata function

Impact

For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS).

Patches

Fixed in vega-functions 6.1.1

Workarounds

There is no workaround besides upgrading. Using vega.expressionInterpreter as described in CSP safe mode does not prevent this issue.

Exploit Proof of Concept

Vega's expression modify() function, used by setdata, allows attacker to control both the method called and the values supplied, which results to XSS . This was a previous POC:

{
  "$schema": "https://vega.github.io/schema/vega/v6.json",
  "data": [
    {
      "name": "table",
      "values": [
        {"category": "A", "amount": 28}
      ]...

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
npm	vega-functions	>=0 <6.1.1	6.1.1
debian 14	vega.js	=5.28.0+ds+~cs5.3.0-1 \|\| =5.28.0+ds+~cs5.3.0-2 \|\| =5.28.0+ds+~cs5.3.0-3 \|\| =5.33.1+ds+~cs5.3.0-1 \|\| >=0 <5.33.1+ds+~cs5.3.0-2	5.33.1+ds+~cs5.3.0-2
debian 12	vega.js	=5.22.1+ds+~3.1.0-4 \|\| =5.25.0+ds+~cs5.3.0-1 \|\| =5.25.0+ds+~cs5.3.0-2 \|\| =5.25.0+ds+~cs5.3.0-3 \|\| =5.25.0+ds+~cs5.3.0-4 \|\| =5.25.0+ds+~cs5.3.0-5 \|\| =5.28.0+ds+~cs5.3.0-1 \|\| =5.28.0+ds+~cs5.3.0-2 \|\| =5.28.0+ds+~cs5.3.0-3 \|\| =5.33.1+ds+~cs5.3.0-1 \|\| =5.33.1+ds+~cs5.3.0-2 \|\| =5.33.1+ds+~cs5.3.0-3 \|\| =5.33.1+ds+~cs5.3.0-4	-
debian 13	vega.js	=5.28.0+ds+~cs5.3.0-1 \|\| =5.28.0+ds+~cs5.3.0-2 \|\| =5.28.0+ds+~cs5.3.0-3 \|\| =5.33.1+ds+~cs5.3.0-1 \|\| =5.33.1+ds+~cs5.3.0-2 \|\| =5.33.1+ds+~cs5.3.0-3 \|\| =5.33.1+ds+~cs5.3.0-4	-

Aliases

1. CVE-2025-666482. NVD-2025-666483. OSV-2025-666484. OSV-DEBIAN-2025-666485. GHSA-m9rg-mr6g-75gm6. GCVE-2025-666487. SECURITY-TRACKER-CVE-2025-66648

References

1. https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm