Cross-site Scripting (XSS)

🗓️ 13 Mar 2026 05:15:02Reported by Veracode Vulnerability DatabaseType

Vega cross site scripting via window attachment enables arbitrary code with malicious Vega data.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	2 Mar 202611:21	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2025-59840)	16 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	2 Mar 202614:44	–	ibm
BDU FSTEC	The vulnerability of Kibana’s visualization data library “Vega” allows attackers to perform cross-site scripting attacks.	17 Nov 202500:00	–	bdu_fstec
Chainguard	CVE-2025-59840 vulnerabilities	2 Jul 202620:22	–	cgr
Circl	CVE-2025-59840	13 Nov 202502:28	–	circl
CNNVD	Vega 跨站脚本漏洞	13 Nov 202500:00	–	cnnvd
CVE	CVE-2025-59840	13 Nov 202519:54	–	cve
Cvelist	CVE-2025-59840 Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable	13 Nov 202519:54	–	cvelist
Debian CVE	CVE-2025-59840	13 Nov 202519:54	–	debiancve

Vulners

Node

vega_project vegaRange1.0.0–6.1.2js

vega_project vegaRange2.6.5–5.33.0js

Source	Link
vega	www.vega.github.io/editor/
github	www.github.com/vega/vega/security/advisories/GHSA-7f2v-3qq3-vvjf
github	www.github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/index.tsx
github	www.github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/components/renderer/renderer.tsx

18 Jul 2026 06:24Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18.1

EPSS0.00383

SSVC