CVE-2025-66648

Name	CVE-2025-66648
Description	vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1125185

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vega.js (PTS)	bookworm	5.22.1+ds+~3.1.0-4	vulnerable
	forky, trixie	5.28.0+ds+~cs5.3.0-1	vulnerable
	sid	5.28.0+ds+~cs5.3.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vega.js	source	(unstable)	(unfixed)			1125185

https://github.com/vega/vega/security/advisories/GHSA-m9rg-mr6g-75gm