CVE-2025-66648 - CVE House
Back to Database
Status published High CVE-2025-66648

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Vulnerability Description

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66648

Credits & Attribution

No credits recorded in the NVD database.

References

More from vega

View All →
CVE-2025-65110
Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope
High 8.1
CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
High 8.1
CVE-2025-27793
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Medium 5.3
CVE-2025-26619
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`
Medium 5.3
CVE-2025-25304
Vega allows Cross-site Scripting via the vlSelectionTuples function
Medium 6.9

Affected Vendor

Affected Software

vega
Vulnerable Versions:
< 6.1.1

Timeline

Official Publish: January 5th, 2026
Last Modified: January 6th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact