What’s Vulnerable › Products

vega vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your vega version is affected

Latest vega vulnerabilities

• CVE-2025-65110 — Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope (CVSS 9.3)
• CVE-2025-59840 — Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable (CVSS 8.1)
• CVE-2025-27793 — Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] (CVSS 5.3)
• CVE-2025-26619 — Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` (CVSS 6.1)
• CVE-2025-25304 — Vega allows Cross-site Scripting via the vlSelectionTuples function (CVSS 6.9)
• CVE-2023-26487 — Vega has cross-site scripting vulnerability in `lassoAppend` function (CVSS 6.1)
• CVE-2023-26486 — Vega `scale` expression function cross site scripting (CVSS 6.1)
• CVE-2020-26296 — XSS in Vega (CVSS 8.7)
• CVE-2019-10806 — (CVSS 4.3)