CVE-2025-66648: vega-functions provides function implementations for the Vega expression language

This week

HIGH 7.2REMOTEUPGRADE

CVE-2025-66648 is a high-severity flaw (CVSS 7.2) affecting vega-functions. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not p

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.2% (top 87%)
CISA exploited list	No
Weakness	CWE-79
Published	2026-01-05
Last modified	2026-10-14

Publisher (CNA): GitHub, Inc. · Vendor: vega-functions project

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-01-05 22:15 UTCPublished CVE record published
2026-10-14 19:10 UTCUpdated Record last modified

vega-functions project vega-functions UPGRADE

Affected: < 6.1.1

Fixed in: 6.1.1

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls vega-functions

2. UPGRADE to 6.1.1

npm install vega-functions@">=6.1.1"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-66648?

vega-functions: upgrade to 6.1.1. Exact commands for each OS are on this page.

Is CVE-2025-66648 being exploited?

CVE-2025-66648 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-66648 affect?

CVE-2025-66648 affects vega-functions. Severity is high (CVSS 7.2). vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could b

How urgent is CVE-2025-66648?

Priority 39/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2025-26619 MEDIUM 6.1 UPGRADE UPGRADE Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualizat

References

← Back to latest CVEs