PT-2026-1339 · Vega+1 · Vega+1

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-65110

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vega versions prior to 6.1.2 Vega versions prior to 5.6.3

Description Vega is a visualization grammar used for creating and sharing interactive visualization designs. Applications using Vega prior to versions 6.1.2 and 5.6.3 are susceptible to arbitrary JavaScript code execution, even when utilizing "safe mode" expressionInterpreter. This occurs when the application attaches both the vega library and a vega.View instance to the global window or has other function gadgets in the global scope, and allows user-defined Vega JSON definitions. The issue allows for DOM-based Cross-Site Scripting (XSS), potentially stored or reflected, requiring user interaction to trigger. An attacker can exploit this by tricking a user into opening a malicious Vega specification, leading to the execution of arbitrary JavaScript code within the application's domain. This can result in the theft of sensitive information, data manipulation, or unauthorized actions. The vulnerability compromises the confidentiality and integrity of impacted applications.

Recommendations Versions prior to 6.1.2 should be updated to 6.1.2 or later. Versions prior to 5.6.3 should be updated to 5.6.3 or later. Do not attach vega or vega.View instances to global variables or the window.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65110

GHSA-829Q-M3QG-PH8R

Affected Products

Debian

Vega

References · 13

• 🔥 https://github.com/vega/vega/security/advisories/GHSA-829q-m3qg-ph8r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65110.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65110 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65110 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65110 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-65110 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65110 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-65110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-829q-m3qg-ph8r · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-65110 · Vendor Advisory
• https://github.com/vega/vega · Note
• https://t.me/CVEtracker/41431 · Telegram Post
• https://twitter.com/CVEnew/status/2008346557817696720 · Twitter Post