CVE-2025-66648
Last modified
CVE-2025-66648 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vega-Functions Project | Vega-Functions | < 6.1.1 |
References
- https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gmExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66648?
How severe is CVE-2025-66648?
How do I fix CVE-2025-66648?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66635Stack-based buffer overflow vulnerability exists in SEIKO EP…8.6
- CVE-2025-6664A vulnerability, which was classified as problematic, was fo…4.3
- CVE-2025-66644Array Networks ArrayOS AG before 9.4.5.9 allows command inje…9.8
- CVE-2025-66645NiceGUI is a Python-based UI framework. Versions 3.3.1 and b…7.5
- CVE-2025-66646RIOT is an open-source microcontroller operating system, des…7.5
- CVE-2025-66647RIOT is an open-source microcontroller operating system, des…9.8
- CVE-2025-66649Rejected reason: Further research determined the issue is no…
- CVE-2025-6665A vulnerability has been found in code-projects Inventory Ma…9.8
- CVE-2025-6666A vulnerability was determined in motogadget mo.lock Ignitio…2
- CVE-2025-66660Insufficient parameter sanitization in TEE SOC Driver could …1.8
- CVE-2025-66664Insufficient parameter sanitization in AMD Secure Processor …4.6
- CVE-2025-6667A vulnerability was found in code-projects Car Rental System…8.8
Are you affected by CVE-2025-66648?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST