PT-2025-46878 · Vega+2 · Vega+3

Published 2025-11-12 · Updated 2025-12-09 · CVE-2025-59840

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Vega versions prior to 6.2.0 vega-expression versions prior to 6.1.0 vega-interpreter versions prior to 2.2.1 vega-expression versions prior to 5.2.1 vega-interpreter versions prior to 1.2.1

Description Vega is a visualization grammar used for creating and sharing interactive visualization designs. Applications using Vega are at risk of arbitrary JavaScript code execution if they meet two conditions: they use the vega library and a vega.View instance attached to the global window object, and they allow user-defined Vega JSON definitions. This issue can be exploited even when the "safe mode" expressionInterpreter is used. The root cause is the exposure of event member get of window objects, which allows a crafted object to override its toString method and achieve DOM XSS. A proof-of-concept (PoC) demonstrates how to achieve XSS by leveraging a gadget in the global VEGA DEBUG code. The vulnerability requires user interaction with the page to trigger and can lead to the theft of sensitive information or unauthorized actions.

Recommendations Upgrade to vega 6.2.0 Upgrade to vega-expression 6.1.0 Upgrade to vega-interpreter 2.2.1 Upgrade to vega-expression 5.2.1 Upgrade to vega-interpreter 1.2.1 Do not attach vega View instances to global variables. Do not attach vega to the global window.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-14394

CVE-2025-59840

GHSA-7F2V-3QQ3-VVJF

Affected Products

Debian

Vega

Vega-Expression

Vega-Interpreter

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59840.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-59840 · Security Note
• https://ubuntu.com/security/CVE-2025-59840 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59840 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59840 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59840 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14394 · Security Note
• https://osv.dev/vulnerability/GHSA-7f2v-3qq3-vvjf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59840 · Vendor Advisory
• https://github.com/vega/vega · Note
• https://github.com/vega/vega/security/advisories/GHSA-7f2v-3qq3-vvjf · Note
• https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/components/renderer/renderer.tsx#L239 · Note
• https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/index.tsx#L14-L16 · Note
• https://t.me/pentestingnews/70862 · Telegram Post