{
  "cveId": "CVE-2025-65110",
  "url": "https://patchblox.com/security/cve/CVE-2025-65110",
  "summary": "CVE-2025-65110 is fixed in vega.js on 1 platform by DEBIAN-CVE-2025-65110 (version 5.33.1\u002Bds\u002B~cs5.3.0-4), released January 5, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "vega.js: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization des...",
  "description": "Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if \u0022safe mode\u0022 expressionInterpreter is used. First, they use \u0060vega\u0060 in an application that attaches both \u0060vega\u0060 library and a \u0060vega.View\u0060 instance similar to the Vega Editor to the global \u0060window\u0060, or has any other satisfactory function gadgets in the global scope. Second, they allow user-defined Vega \u0060JSON\u0060 definitions (vs JSON that was is only provided through source code). This vulnerability allows for DOM XSS, potentially stored, potentially reflected, depending on how the library is being used. The vulnerability requires user interaction with the page to trigger. An attacker can exploit this issue by tricking a user into opening a malicious Vega specification. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the application\u2019s domain. This can lead to theft of sensitive information such as authentication tokens, manipulation of data displayed to the user, or execution of unauthorized actions on behalf of the victim. This exploit compromises confidentiality and integrity of impacted applications.Patched versions are available in \u0060vega-selections@6.1.2\u0060 (requires ESM) for Vega v6 and \u0060vega-selections@5.6.3\u0060 (no ESM needed) for Vega v5. As a workaround, do not attach \u0060vega\u0060 or \u0060vega.View\u0060 instances to global variables or the window as the editor used to do. This is a development-only debugging practice that should not be used in any situation where Vega/Vega-lite definitions can come from untrusted parties.",
  "published": "2026-01-05T22:15:51Z",
  "severity": "critical",
  "cvss": 9.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
  "epss": 0.00504,
  "epssPercentile": 0.43331,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "vega.js",
      "release": "Debian 14",
      "fixedVersion": "5.33.1\u002Bds\u002B~cs5.3.0-4",
      "fix": "DEBIAN-CVE-2025-65110",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-65110",
      "released": "2026-01-05T22:15:51Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}