MEDIUM6.1npm
GHSA-4vq7-882g-wcg4· CVE-2023-26486Vega Expression Language `scale` expression function Cross Site Scripting
Modified: 9/10/2026
package
npm/vega-functions
pkg:npm/vega-functions
MEDIUMnpm
GHSA-963h-3v39-3pqf· CVE-2025-27793Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Modified: 3/27/2025
HIGH7.2npm
GHSA-m9rg-mr6g-75gm· CVE-2025-66648`vega-functions` vulnerable to Cross-site Scripting via `setdata` function
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-rcw3-wmx7-cphr· CVE-2025-26619Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-w5m3-xh75-mp55· CVE-2023-26487Vega has Cross-site Scripting vulnerability in `lassoAppend` function
Modified: 9/10/2026