npmPackage

vega

7 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 6.4.0 (Aug 14, 2026): no advisory affects it
Newest unaffected release: 6.4.0 (Aug 14, 2026), the latest release
Advisories: 7 · 2 high, 5 medium

Weekly downloads: 1.8M
Dependents: 152
Releases: 193 since 1.0.0 (Apr 2, 2013)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2025-59840
Affects 1.0.0 to 6.1.2 (6.2.0 is outside it)
CVE-2025-27793
Affects 1.0.0 to 5.31.0 (5.32.0 is outside it)
CVE-2025-26619
Affects 1.0.0 to 5.30.0 (5.31.0 is outside it)
CVE-2025-25304
Affects 1.0.0 to 5.25.0 (5.26.0 is outside it)
CVE-2023-26486
Affects 1.0.0 to 5.22.1 (5.23.0 is outside it)
CVE-2023-26487
Affects 1.0.0 to 5.22.1 (5.23.0 is outside it)
CVE-2020-26296
Affects 1.0.0 to 5.17.2 (5.17.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2025-59840High 8.1
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
Affected: fixed in 6.2.0.
Fixed in 6.2.0 (released Sep 16, 2025, 58 days before disclosure).
The latest release, 6.4.0, is not affected.
23% of vega downloads last week were affected versions (490.4K).
CVE-2025-27793Medium 5.3
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Affected: fixed in 5.32.0.
Fixed in 5.32.0 (released Feb 25, 2025, 30 days before disclosure).
The latest release, 6.4.0, is not affected.
5.3% of vega downloads last week were affected versions (112.7K).
CVE-2025-26619Medium 5.3
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`
Affected: fixed in 5.31.0.
Fixed in 5.31.0 (released Jan 24, 2025, 62 days before disclosure).
The latest release, 6.4.0, is not affected.
5.2% of vega downloads last week were affected versions (110.2K).
CVE-2025-25304Medium 6.9
Vega allows Cross-site Scripting via the vlSelectionTuples function
Affected: fixed in 5.26.0.
Fixed in 5.26.0 (released Nov 7, 2023, 465 days before disclosure).
The latest release, 6.4.0, is not affected.
3.3% of vega downloads last week were affected versions (69.3K).
CVE-2023-26486Medium 6.5
Vega `scale` expression function cross site scripting
Affected: fixed in 5.23.0.
Fixed in 5.23.0 (released Mar 1, 2023, 2 days before disclosure).
The latest release, 6.4.0, is not affected.
1.4% of vega downloads last week were affected versions (29.9K).
CVE-2023-26487Medium 6.5
Vega has cross-site scripting vulnerability in `lassoAppend` function
Affected: fixed in 5.23.0.
Fixed in 5.23.0 (released Mar 1, 2023, 2 days before disclosure).
The latest release, 6.4.0, is not affected.
1.4% of vega downloads last week were affected versions (29.9K).
CVE-2020-26296High 8.7
XSS in Vega
Affected: fixed in 5.17.3.
Fixed in 5.17.3 (released Dec 23, 2020, 7 days before disclosure).
The latest release, 6.4.0, is not affected.
0.5% of vega downloads last week were affected versions (11.2K).