Skip to main content
cve.nowby Sazabi
← npm
npmPackage

vega-functions

5 known vulnerabilities (1 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 high, 4 medium
Weekly downloads
1.9M
Dependents
168
Registry
npm

Advisories 5

  • `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

    Affected: fixed in 6.1.1.

  • CVE-2025-27793Medium 5.3

    Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

    Affected: fixed in 5.17.0.

  • CVE-2025-26619Medium 5.3

    Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

    Affected: fixed in 5.16.0.

  • CVE-2023-26486Medium 6.5

    Vega `scale` expression function cross site scripting

    Affected: fixed in 5.13.1.

  • CVE-2023-26487Medium 6.5

    Vega has cross-site scripting vulnerability in `lassoAppend` function

    Affected: fixed in 5.13.1.