Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive     visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the     `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site     scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including     one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary     JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to     call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
    (CVE-2025-25304)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e50201543b advisory.

    Update to 4.3.6 (rhbz#2352545)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1d68ba6806 advisory.

    Update to 4.3.6 (rhbz#2352545)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive
    visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the
    `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site
    scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including
    one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary
    JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to
    call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
    (CVE-2025-25304)

ID	Name	Product	Family	Severity
261166	Linux Distros Unpatched Vulnerability : CVE-2025-25304	Nessus	Misc.	medium
233278	Fedora 41 : jupyterlab (2025-e50201543b)	Nessus	Fedora Local Security Checks	medium
233277	Fedora 40 : jupyterlab (2025-1d68ba6806)	Nessus	Fedora Local Security Checks	medium
420905	SCA: security update for vega, vega-selections (GHSA-mp7w-mhcv-673j)	Tenable Cloud Security	SCA Checks	medium
420905	SCA: security update for vega, vega-selections (GHSA-mp7w-mhcv-673j)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-25304

medium

Tenable Plugins

medium

medium

medium

medium

medium