@0xgg/echomd (>=1.0.2, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +175 more potentially affected by CVE-2025-59840 via vega-expression (>=5.0.1, <=5.1.2)

🗓️ 13 Nov 2025 22:32:35Reported by Vulners OSVType

vega-expression v5.0.1-v5.1.2 has a vulnerability (CVE-2025-59840) affecting 175+ NPM packages via transitive dependency.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	2 Mar 202611:21	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2025-59840)	16 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	2 Mar 202614:44	–	ibm
BDU FSTEC	The vulnerability of Kibana’s visualization data library “Vega” allows attackers to perform cross-site scripting attacks.	17 Nov 202500:00	–	bdu_fstec
Chainguard	CVE-2025-59840 vulnerabilities	2 Jul 202620:22	–	cgr
Circl	CVE-2025-59840	13 Nov 202502:28	–	circl
CNNVD	Vega 跨站脚本漏洞	13 Nov 202500:00	–	cnnvd
CVE	CVE-2025-59840	13 Nov 202519:54	–	cve
Cvelist	CVE-2025-59840 Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable	13 Nov 202519:54	–	cvelist
Debian CVE	CVE-2025-59840	13 Nov 202519:54	–	debiancve

02 Jul 2026 17:59Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

EPSS0.00392

SSVC