Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive     visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was     possible to call JavaScript functions from the Vega expression language that were not meant to be     supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are     available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower.
    Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents     arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
    (CVE-2025-26619)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive
    visualization designs. In `vega` 5.30.0 and lower and in `vega-functions` 5.15.0 and lower , it was
    possible to call JavaScript functions from the Vega expression language that were not meant to be
    supported. The issue is patched in `vega` `5.31.0` and `vega-functions` `5.16.0`. Some workarounds are
    available. Run `vega` without `vega.expressionInterpreter`. This mode is not the default as it is slower.
    Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents
    arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
    (CVE-2025-26619)

ID	Name	Product	Family	Severity
261172	Linux Distros Unpatched Vulnerability : CVE-2025-26619	Nessus	Misc.	medium
421247	SCA: security update for vega, vega-functions (GHSA-rcw3-wmx7-cphr)	Tenable Cloud Security	SCA Checks	medium
421247	SCA: security update for vega, vega-functions (GHSA-rcw3-wmx7-cphr)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-26619

medium

Tenable Plugins

medium

medium

medium