CVE catalog

CVE-2025-26619

vega.js: CVE-2025-26619

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvega.jssid5.33.1+ds+~cs5.3.0-4fixed
Debianvega.jsforky5.33.1+ds+~cs5.3.0-4fixed
Debianvega.jstrixie5.28.0+ds+~cs5.3.0-1vulnerable
Debianvega.jsbookworm5.22.1+ds+~3.1.0-4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvega.jssourcesid5.33.1+ds+~cs5.3.0-1not yet assignedNot reported[1125181]
Debianvega.jssourceforky5.33.1+ds+~cs5.3.0-1not yet assignedNot reported[1125181]
Debianvega.jssourcetrixie(unfixed)not yet assignedNot reported[1125181]
Debianvega.jssourcebookworm(unfixed)not yet assignedNot reported[1125181]

[Debian bug #1125181]

Notes

[trixie] vega.js: Minor issue [bookworm] vega.js: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjs-vega]Affected

    Source package: [vega.js]

    Details (2)

    • 5.22.1+ds+~3.1.0-4 · all · bookworm

      Affected

      dsa · vega.js · debian · bookworm; dsa · vega.js · debian · 12

    • 5.22.1+ds+~3.1.0-4 · all · bookworm

      Affected

      dsa · vega.js · debian · bookworm; dsa · vega.js · debian · 12

  • [node-vega]Affected

    Source package: [vega.js]

    Details (2)

    • 5.22.1+ds+~3.1.0-4 · all · bookworm

      Affected

      dsa · vega.js · debian · bookworm; dsa · vega.js · debian · 12

    • 5.22.1+ds+~3.1.0-4 · all · bookworm

      Affected

      dsa · vega.js · debian · bookworm; dsa · vega.js · debian · 12

[Debian 13 (Trixie)]

  • [libjs-vega]Affected

    Source package: [vega.js]

    Details (2)

    • 5.28.0+ds+~cs5.3.0-1 · all · trixie

      Affected

      dsa · vega.js · debian · 13

    • 5.28.0+ds+~cs5.3.0-1 · all · trixie

      Affected

      dsa · vega.js · debian · 13

  • [node-vega]Affected

    Source package: [vega.js]

    Details (2)

    • 5.28.0+ds+~cs5.3.0-1 · all · trixie

      Affected

      dsa · vega.js · debian · 13

    • 5.28.0+ds+~cs5.3.0-1 · all · trixie

      Affected

      dsa · vega.js · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]