PT-2025-52263 · Vega · Vega

Catalin Iovita · Published 2025-12-18 · Updated 2025-12-19 · CVE-2025-14896

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Vega (affected versions not specified)

Description The software contains a flaw due to inadequate input validation within the convert() function when safeMode is active and the spec variable is an array. This allows an attacker to create a specially crafted Vega diagram specification that can send requests to any URL, potentially including local file system paths. This could lead to the disclosure of sensitive information. The vulnerable parameter is spec.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-14896

Affected Products

Vega

References · 6

• https://osv.dev/vulnerability/CVE-2025-14896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14896 · Security Note
• https://github.com/yuzutech/kroki/commit/f31093cd8a0a1d6999c43d560f62d1e82d59c77e · Note
• https://twitter.com/VulmonFeeds/status/2001815790878658884 · Twitter Post
• https://t.me/CVEtracker/40165 · Telegram Post
• https://twitter.com/CVEnew/status/2001728015399817354 · Twitter Post