CVE-2025-66648
7.2
Vega's Visual Betrayal: Leaking the Window via Internal Functions
Alon Barad
Software EngineerJan 6, 2026·7 min read·15 visits
PoC Available
Executive Summary (TL;DR)
Vega, the popular visualization grammar, failed to sanitize inputs to its internal `modify()` function. Attackers can craft a malicious JSON specification that traverses internal object references (via `event.dataflow`) to reach the browser's global scope (`window`). By passing a function reference like `window.alert` into `modify()`, the engine unwittingly executes it. Fixed in `vega-functions` 6.1.1.
A high-severity Cross-Site Scripting (XSS) vulnerability exists in the Vega expression language (`vega-functions`). By leveraging the internal `modify` function and traversing the `dataflow` object graph, attackers can access the global `window` object and execute arbitrary JavaScript.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS Score
7.2/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NAffected Systems
vega-functions < 6.1.1Vega visualization libraryApplications embedding Vega (e.g., Kibana, Jupyter)
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
vega-functions Vega | < 6.1.1 | 6.1.1 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-79 |
| Attack Vector | Network |
| CVSS Score | 7.2 (High) |
| Exploit Status | PoC Available |
| Impact | Code Execution / XSS |
| Vulnerability Type | Improper Input Neutralization |
MITRE ATT&CK Mapping
CWE-79
Cross-site Scripting
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Known Exploits & Detection
Vulnerability Timeline
Fix committed to Vega repository
2025-12-05
Public disclosure of CVE-2025-66648
2026-01-05
GHSA Advisory published
2026-01-05