Arbitrary JavaScript Code Execution in Vega Visualization Library by Vega
CVE-2025-59840
What is CVE-2025-59840?
The Vega visualization grammar is susceptible to arbitrary JavaScript code execution in versions prior to 6.2.0 when certain conditions are met. Specifically, if an application integrates the Vega library and exposes a vega.View instance to the global window while allowing user-defined Vega JSON definitions, a potential attacker could exploit this to execute malicious scripts. This risk persists even under 'safe mode' if not mitigated by adhering to best practices, such as avoiding the attachment of vega instances to global variables and refraining from exposing them to untrusted sources. It is crucial for users to update to the fixed versions of the Vega products and implement recommended workarounds to safeguard their applications.
Affected Version(s)
vega vega < 6.2.0 < vega 6.2.0
vega vega-expression >= 6.0.0, < 6.1.0 < vega-expression 6.0.0, 6.1.0
vega vega-expression < 5.2.1 < vega-expression 5.2.1