CVE-2025-59840
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vega | vega | 6.2.0 |
| vega | vega-expression | 1.2.1 |
| vega | vega-expression | 5.2.1 |
| vega | vega-interpreter | 2.2.1 |
| vega | vega-expression | 6.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Vega versions prior to 6.2.0 where applications that attach the vega library and a vega.View instance to the global window object, and allow user-defined Vega JSON definitions, are at risk of arbitrary JavaScript code execution. This can happen even if the 'safe mode' expressionInterpreter is used. The issue arises because attaching these instances globally and accepting untrusted JSON definitions can enable attackers to execute malicious code.
How can this vulnerability impact me? :
If your application uses vulnerable versions of Vega and follows the risky practice of attaching vega and vega.View instances to the global window object while accepting user-defined Vega JSON, attackers could execute arbitrary JavaScript code in your application context. This can lead to compromise of confidentiality and integrity of data, unauthorized actions, and potentially harm users or systems relying on the application.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your application uses the vega library and attaches a vega.View instance to the global window object, especially if user-defined Vega JSON definitions are allowed. There are no specific commands provided to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading to vega 6.2.0, vega-expression 6.1.0, and vega-interpreter 2.2.1 if using the latest Vega line (6.x). If using Vega in a non-ESM environment, upgrade to vega-expression 5.2.1 or 1.2.1 if using AST evaluator mode. Additionally, do not attach vega or vega.View instances to global variables or the global window object, especially in production or where untrusted Vega/vega-lite definitions may be provided.