{"id":"CVE-2025-27793","aliases":["DEBIAN-CVE-2025-27793","EUVD-2025-14832","GHSA-963h-3v39-3pqf","UBUNTU-CVE-2025-27793"],"status":"published","title":"Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00517,"percentile":0.4447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-87"],"published":"2025-03-27T14:07:52Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"npm","package":"vega","fixed_in":["5.32.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vega-functions","fixed_in":["5.17.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"vega.js","fixed_in":["5.33.1+ds+~cs5.3.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vega","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vega-functions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+ds+~3.1.0-4","5.25.0+ds+~cs5.3.0-1","5.25.0+ds+~cs5.3.0-2","5.25.0+ds+~cs5.3.0-3","5.25.0+ds+~cs5.3.0-4","5.25.0+ds+~cs5.3.0-5","5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2","5.28.0+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-1","5.33.1+ds+~cs5.3.0-2","5.33.1+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2","5.28.0+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-1","5.33.1+ds+~cs5.3.0-2","5.33.1+ds+~cs5.3.0-3","5.33.1+ds+~cs5.3.0-4"]},{"source":"osv","ecosystem":"Debian:14","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.33.1+ds+~cs5.3.0-1"}]}],"versions":["5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2","5.28.0+ds+~cs5.3.0-3"]},{"source":"osv","ecosystem":"npm","package":"vega","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.32.0"}]}]},{"source":"osv","ecosystem":"npm","package":"vega-functions","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.17.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.25.0+ds+~cs5.3.0-2","5.25.0+ds+~cs5.3.0-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.0+ds+~cs5.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.0+ds+~cs5.3.0-2","5.33.1+ds+~cs5.3.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vega.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.0+ds+~cs5.3.0-1","5.28.0+ds+~cs5.3.0-2"]}],"products":[{"vendor":"vega","product":"vega"}],"references":[{"url":"https://github.com/vega/vega/security/advisories/GHSA-963h-3v39-3pqf","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vega/vega/releases/tag/v5.32.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://vega.github.io/vega/usage/interpreter","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27793","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-963h-3v39-3pqf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27793.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27793","tags":["advisory"]},{"url":"https://github.com/vega/vega","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-27793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27793","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-27793","title":"Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:07:52.264Z","modified":"2025-03-27T15:17:18.354Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-87","CWE-79"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-14832","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:07:52Z","modified":"2025-03-27T15:17:18Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:49.499517Z"}],"ghsa":[{"id":"GHSA-963h-3v39-3pqf","title":"Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]","description":"## Impact\n\nUsers running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the `vega-interpreter`.\n\n## Workarounds\n\n- Use `vega` with [expression interpreter](https://vega.github.io/vega/usage/interpreter/)\n- Upgrade to a [newer Vega version](https://github.com/vega/vega/releases/tag/v5.32.0) (`5.32.0`)\n\n### POC Summary\n\nCalling `replace` with a `RegExp`-like pattern calls `RegExp.prototype[@@replace]`, which can then call an attacker-controlled `exec` function.\n\n### POC Details\n\nConsider the function call `replace('foo', {__proto__: /h/.constructor.prototype, global: false})`. Since `pattern` has `RegExp.prototype[@@replace]`, `pattern.exec('foo')` winds up being called.\n\nThe resulting malicious call looks like this:\n```\nreplace(\u003cstring argument\u003e, {__proto__: /h/.constructor.prototype, exec: \u003cfunction\u003e, global: false})\n```\n\nSince functions cannot be returned from this, an attacker that wishes to escalate to XSS must abuse `event.view` to gain access to `eval`.\n\n### Reproduction steps\n\n```\n{\"$schema\":\"https://vega.github.io/schema/vega/v5.json\",\"signals\":[{\"name\":\"a\",\"on\":[{\"events\":\"body:mousemove{99999}\",\"update\":\"replace('alert(1)',{__proto__:/h/.constructor.prototype,exec:event.view.eval,global:false})\"}]}]}\n```","status":"published","published":"2025-03-27T18:00:24Z","modified":"2025-03-27T18:00:25Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-87"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2025-27793","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:15:54.06Z","modified":"2026-06-17T09:04:14.073Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79","CWE-87"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"CVE-2025-27793","title":"Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:07:52.264Z","modified":"2026-10-28T02:31:12.123596965Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-87"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-27793","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:15:54.06Z","modified":"2026-09-01T20:05:45.334665114Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-963h-3v39-3pqf","title":"Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]","description":"## Impact\n\nUsers running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the `vega-interpreter`.\n\n## Workarounds\n\n- Use `vega` with [expression interpreter](https://vega.github.io/vega/usage/interpreter/)\n- Upgrade to a [newer Vega version](https://github.com/vega/vega/releases/tag/v5.32.0) (`5.32.0`)\n\n### POC Summary\n\nCalling `replace` with a `RegExp`-like pattern calls `RegExp.prototype[@@replace]`, which can then call an attacker-controlled `exec` function.\n\n### POC Details\n\nConsider the function call `replace('foo', {__proto__: /h/.constructor.prototype, global: false})`. Since `pattern` has `RegExp.prototype[@@replace]`, `pattern.exec('foo')` winds up being called.\n\nThe resulting malicious call looks like this:\n```\nreplace(\u003cstring argument\u003e, {__proto__: /h/.constructor.prototype, exec: \u003cfunction\u003e, global: false})\n```\n\nSince functions cannot be returned from this, an attacker that wishes to escalate to XSS must abuse `event.view` to gain access to `eval`.\n\n### Reproduction steps\n\n```\n{\"$schema\":\"https://vega.github.io/schema/vega/v5.json\",\"signals\":[{\"name\":\"a\",\"on\":[{\"events\":\"body:mousemove{99999}\",\"update\":\"replace('alert(1)',{__proto__:/h/.constructor.prototype,exec:event.view.eval,global:false})\"}]}]}\n```","status":"published","published":"2025-03-27T18:00:24Z","modified":"2025-03-27T18:08:39.051781Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-87"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2025-27793","description":"Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.","status":"published","published":"2025-03-27T14:15:00Z","modified":"2026-10-17T12:56:49.633707172Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}