Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive     visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version     5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing     graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions     version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter. (CVE-2025-27793)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-e15a193ad3 advisory.

    New jupyterlab and notebook

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-5ea8e7d744 advisory.

    New jupyterlab and notebook

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive
    visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version
    5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing
    graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions
    version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter. (CVE-2025-27793)

ID	Name	Product	Family	Severity
261176	Linux Distros Unpatched Vulnerability : CVE-2025-27793	Nessus	Misc.	medium
234699	Fedora 41 : jupyterlab / python-notebook (2025-e15a193ad3)	Nessus	Fedora Local Security Checks	medium
234646	Fedora 40 : jupyterlab / python-notebook (2025-5ea8e7d744)	Nessus	Fedora Local Security Checks	medium
421245	SCA: security update for vega, vega-functions (GHSA-963h-3v39-3pqf)	Tenable Cloud Security	SCA Checks	medium
421245	SCA: security update for vega, vega-functions (GHSA-963h-3v39-3pqf)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-27793

medium

Tenable Plugins

medium

medium

medium

medium

medium