MEDIUM6.1npm
GHSA-4vq7-882g-wcg4· CVE-2023-26486Vega Expression Language `scale` expression function Cross Site Scripting
Modified: 9/10/2026
package
npm/vega
pkg:npm/vega
HIGH8.1npm
GHSA-7f2v-3qq3-vvjf· CVE-2025-59840Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
Modified: 9/10/2026
MEDIUMnpm
GHSA-963h-3v39-3pqf· CVE-2025-27793Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Modified: 3/27/2025
MEDIUMnpm
GHSA-cp47-r258-q626Vega vulnerable to arbitrary code execution when clicking href links
Modified: 3/2/2023
MEDIUMnpm
GHSA-mp7w-mhcv-673j· CVE-2025-25304Vega allows Cross-site Scripting via the vlSelectionTuples function
Modified: 2/14/2025
HIGH8.7npm
GHSA-r2qc-w64x-6j54· CVE-2020-26296XSS in Vega
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-rcw3-wmx7-cphr· CVE-2025-26619Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-w5m3-xh75-mp55· CVE-2023-26487Vega has Cross-site Scripting vulnerability in `lassoAppend` function
Modified: 9/10/2026