https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:11:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-217758 EUVD-2026-217758 https://cve.radiocsirt.org/vuln/euvd-2026-217758 https://cve.radiocsirt.org/vuln/fkie_cve-2025-25304 <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.</p> <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-25304 https://cve.radiocsirt.org/vuln/ghsa-mp7w-mhcv-673j <p><strong>Affected:</strong> npm: vega, npm: vega-selections</p> <p>### Summary The `vlSelectionTuples` function can be used to call JavaScript functions, leading to XSS.</p> <p>### Details [`vlSelectionTuples`](https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14) calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument.</p> <p>Example call: `vlSelectionTuples([{datum:&lt;argument&gt;}], {fields:[{getter:&lt;function&gt;}]})`</p> <p>This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`.</p> <p>### PoC ``` {&#34;$schema&#34;:&#34;https://vega.github.io/schema/vega/v5.json&#34;,&#34;signals&#34;:[{&#34;name&#34;:&#34;a&#34;,&#34;init&#34;:&#34;+{valueOf:vlSelectionTuples([{datum:&#39;alert(1)&#39;}],{fields:[{getter:[].at.constructor}]})[0].values[0]}&#34;}]} ```</p> <p><strong>Affected:</strong> npm: vega, npm: vega-selections</p> <p>### Summary The `vlSelectionTuples` function can be used to call JavaScript functions, leading to XSS.</p> <p>### Details [`vlSelectionTuples`](https://github.com/vega/vega/blob/b45cf431cd6c0d0c0e1567f087f9b3b55bc236fa/packages/vega-selections/src/selectionTuples.js#L14) calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument.</p> <p>Example call: `vlSelectionTuples([{datum:&lt;argument&gt;}], {fields:[{getter:&lt;function&gt;}]})`</p> <p>This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`.</p> <p>### PoC ``` {&#34;$schema&#34;:&#34;https://vega.github.io/schema/vega/v5.json&#34;,&#34;signals&#34;:[{&#34;name&#34;:&#34;a&#34;,&#34;init&#34;:&#34;+{valueOf:vlSelectionTuples([{datum:&#39;alert(1)&#39;}],{fields:[{getter:[].at.constructor}]})[0].values[0]}&#34;}]} ```</p> https://cve.radiocsirt.org/vuln/ghsa-mp7w-mhcv-673j https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-25304 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: vega.js, Ubuntu:25.10: vega.js, Ubuntu:26.04:LTS: vega.js</p> <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: vega.js, Ubuntu:25.10: vega.js, Ubuntu:26.04:LTS: vega.js</p> <p>Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-25304