8.1

CVE-2025-59840: vega Cross-site Scripting

CVSS: 8.1v3.1HighDeferred
AliasesUBUNTU-CVE-2025-59840DEBIAN-CVE-2025-59840CGA-54fw-mg9c-fg5q
Published 13-11-2025Last modified 14-11-2025
Open JSON

Vulnerability summary

CVE-2025-59840 is a high (CVSS 8.1) Cross-site Scripting vulnerability in vega. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.42%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-V5RV-M5J3-7G5V

Timeline

  1. 13-11-2025
    PublishedVulnerability first disclosed.
  2. 14-11-2025
    Last modifiedVulnerability information updated.

Description

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

+0.03 pp

From 0.40% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard7 products
  • jupyter-base-notebook< 7.6.3-r2
  • py3.10-jupyterlab< 4.6.1-r1
  • py3.11-jupyterlab< 4.6.1-r1
  • py3.12-jupyterlab< 4.6.1-r1
  • py3.13-jupyterlab< 4.6.1-r1
Wolfi5 products
  • jupyter-base-notebook< 7.6.3-r2
  • py3.10-jupyterlab< 4.6.1-r1
  • py3.11-jupyterlab< 4.6.1-r1
  • py3.12-jupyterlab< 4.6.1-r1
  • py3.13-jupyterlab< 4.6.1-r1
Npm3 products
  • vega< 6.2.0
  • vega-expression≥ 6.0.0, < 6.1.0 | < 5.2.1
  • vega-interpreter≥ 2.0.0, < 2.2.1 | < 1.2.1
Debian1 product
  • vega.jsAll versions (No fix recorded) | < 5.33.1+ds+~cs5.3.0-4
Ubuntu1 product
  • vega.jsAll versions (No fix recorded)
Vega1 product
  • vegavega < 6.2.0 | vega-expression >= 6.0.0, < 6.1.0 | vega-expression < 5.2.1 | vega-interpreter >= 2.0.0, < 2.2.1 | vega-interpreter < 1.2.1

6 vendors · 18 products

References

11 links
Show all 11 references