PT-2025-13187 · Vega+2 · Vega+2

Kprevas · Published 2025-03-27 · Updated 2025-03-28 · CVE-2025-26619

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vega versions 5.30.0 and lower vega-functions versions 5.15.0 and lower

Description The issue allows calling JavaScript functions from the Vega expression language that were not meant to be supported. This can be mitigated by running vega without vega.expressionInterpreter, although this mode is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running.

Recommendations For vega versions 5.30.0 and lower, update to version 5.31.0 to resolve the issue. For vega-functions versions 5.15.0 and lower, update to version 5.16.0 to resolve the issue. As a temporary workaround, consider running vega without vega.expressionInterpreter to minimize the risk of exploitation. Restrict access to the vega.expressionInterpreter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-26619

GHSA-RCW3-WMX7-CPHR

Affected Products

Debian

Vega

Vega-Functions

References · 15

• 🔥 https://github.com/vega/vega/security/advisories/GHSA-rcw3-wmx7-cphr · Exploit
• 🔥 https://github.com/vega/vega/issues/3984 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26619.json · Exploit
• https://github.com/vega/vega/commit/8fc129a6f8a11e96449c4ac0f63de0e5bfc7254c · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-26619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26619 · Security Note
• https://ubuntu.com/security/CVE-2025-26619 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-26619 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-26619 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-26619 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26619 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rcw3-wmx7-cphr · Vendor Advisory
• https://github.com/vega/vega · Note
• https://github.com/vega/vega-lite/issues/9469 · Note
• https://twitter.com/CVEnew/status/1905300659240587414 · Twitter Post