Skip to main content
cve.nowby Sazabi
← npm
npmPackage

vega-selections

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
6.1.5 (Aug 14, 2026): no advisory affects it
Newest unaffected release
6.1.5 (Aug 14, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Weekly downloads
1.8M
Dependents
174
Releases
26 since 5.0.0 (Feb 18, 2019)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-65110
    Affects 5.0.0 to 5.6.2 (5.6.3 is outside it); 6.0.0 to 6.1.1 (6.1.2 is outside it)
  • CVE-2025-25304
    Affects 5.0.0 to 5.4.1 (5.4.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory…

    Affected: fixed in 5.6.3; from 6.0.0, fixed in 6.1.2.

    Fixed in 5.6.3 (released Nov 23, 2025, 43 days before disclosure) and 6.1.2 (released Nov 23, 2025, 43 days before disclosure).

    The latest release, 6.1.5, is not affected.

    8% of vega-selections downloads last week were affected versions (168.9K).

  • CVE-2025-25304Medium 6.9

    Vega allows Cross-site Scripting via the vlSelectionTuples function

    Affected: fixed in 5.4.2.

    Fixed in 5.4.2 (released Nov 7, 2023, 465 days before disclosure).

    The latest release, 6.1.5, is not affected.

    2.6% of vega-selections downloads last week were affected versions (54.1K).