vega-selections vulnerabilities (npm)

2 vulnerabilities.

• vega-selections npm Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope CVE-2025-65110 Fix available 8.1 HighJanuary 5, 2026
• vega-selections npm Vega allows Cross-site Scripting via the vlSelectionTuples function CVE-2025-25304 Fix available 6.9 MediumFebruary 14, 2025