CVE-2025-26619
Last modified
CVE-2025-26619 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vega-Functions Project | Vega-Functions | < 5.16.0 |
| Vega Project | Vega | < 5.31.0 |
References
- https://github.com/vega/vega-lite/issues/9469Issue Tracking
- https://github.com/vega/vega/issues/3984Exploit, Issue Tracking
- https://github.com/vega/vega/security/advisories/GHSA-rcw3-wmx7-cphrExploit, Vendor Advisory
- https://github.com/vega/vega/security/advisories/GHSA-rcw3-wmx7-cphrExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-26619?
How severe is CVE-2025-26619?
How do I fix CVE-2025-26619?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-26613WeGIA is an open source Web Manager for Institutions with a …9.8
- CVE-2025-26614WeGIA is an open source Web Manager for Institutions with a …8.8
- CVE-2025-26615WeGIA is an open source Web Manager for Institutions with a …7.5
- CVE-2025-26616WeGIA is an open source Web Manager for Institutions with a …7.5
- CVE-2025-26617WeGIA is an open source Web Manager for Institutions with a …9.8
- CVE-2025-26618Erlang is a programming language and runtime system for buil…7
- CVE-2025-2662A vulnerability was found in Project Worlds Online Time Tabl…8.8
- CVE-2025-26620Duende.AccessTokenManagement is a set of .NET libraries that…6.3
- CVE-2025-26621OpenCTI is an open source platform for managing cyber threat…6.8
- CVE-2025-26622vyper is a Pythonic Smart Contract Language for the EVM. Vyp…7.5
- CVE-2025-26623Exiv2 is a C++ library and a command-line utility to read, w…9.8
- CVE-2025-26624Rufus is a utility that helps format and create bootable USB…6.8
Are you affected by CVE-2025-26619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST