CVE-2025-65110
📋 TL;DR
This vulnerability in Vega visualization library allows arbitrary JavaScript execution via DOM-based XSS when applications meet two conditions: they attach Vega library or View instances to global scope, and they accept user-defined Vega JSON specifications. This affects applications that use Vega for interactive visualizations with untrusted input.
💻 Affected Systems
- Vega visualization library
📦 What is this software?
Vega by Vega Project
Vega by Vega Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user sessions, theft of authentication tokens, manipulation of displayed data, and unauthorized actions performed on behalf of victims.
Likely Case
Stored XSS leading to session hijacking and data manipulation when users interact with malicious visualizations.
If Mitigated
No impact if applications don't attach Vega to global scope and only use trusted JSON specifications.
🎯 Exploit Status
Requires user interaction with malicious Vega specification; attacker needs to trick user into opening malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vega-selections@6.1.2 for Vega v6, vega-selections@5.6.3 for Vega v5
Vendor Advisory: https://github.com/vega/vega/security/advisories/GHSA-829q-m3qg-ph8r
Restart Required: No
Instructions:
1. Update Vega dependencies: For Vega v6: npm install vega-selections@6.1.2; For Vega v5: npm install vega-selections@5.6.3. 2. Update package.json accordingly. 3. Rebuild and redeploy application.
🔧 Temporary Workarounds
Remove global scope attachment
allDo not attach vega or vega.View instances to global variables or window object
🧯 If You Can't Patch
- Implement strict input validation for Vega JSON specifications
- Sanitize all user-provided Vega specifications before processing
🔍 How to Verify
Check if Vulnerable:
Check if application attaches vega or vega.View to window object AND accepts user-defined JSON specificationsCheck Version:
npm list vega-selectionsVerify Fix Applied:
Verify vega-selections version is 6.1.2+ for Vega v6 or 5.6.3+ for Vega v5📡 Detection & Monitoring
Log Indicators:
- Unusual Vega specification processing errors
- Suspicious JavaScript execution in visualization contexts
Network Indicators:
- Malicious Vega specifications in user inputs
SIEM Query:
Search for patterns of Vega JSON specifications containing script tags or JavaScript execution patterns