Cloudanix VulnDB

CVE-2025-65110

High · 8.1

Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

CVSS

8.1

EPSS

0.5%

Published

Jan 5, 2026

CISA due date

—

The record

Vega offers the evaluation of expressions in a secure context. Arbitrary function call is prohibited. When an event is exposed to an expression, member get of window objects is possible. Because of this exposure, in some applications, a crafted object that sets a `map` value with a function copied from the window that results in calling `this.foo(this.bar)` can be passed to the vlSelectionTuples function, calling the copied `map` function, allowing DOM XSS to be achieved. In practice, an accessible gadget like this exists in the global VEGA_DEBUG code. ```js vlSelectionTuples({ map: event.view.VEGA_DEBUG.vega.CanvasHandler.prototype.on, eventName: event.view.console.log, _handlers:{ undefined: 'alert(origin + ` XSS on version `+ VEGA_DEBUG.VEGA_VERSION)' }, _handlerIndex: event.view.eval }) ```

Affected packages

Ecosystem Package Introduced Fixed
npm vega-selections 0 5.6.3
npm vega-selections 6.0.0 6.1.2

Related vulnerabilities