Detections
Analytics

SCA: security update for vega-selections (GHSA-829q-m3qg-ph8r)

critical Tenable Cloud Security Plugin ID 436577

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive
 visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk
 of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. First, they use
 `vega` in an application that attaches both `vega` library and a `vega.View` instance similar to the Vega
 Editor to the global `window`, or has any other satisfactory function gadgets in the global scope. Second,
 they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code).
 This vulnerability allows for DOM XSS, potentially stored, potentially reflected, depending on how the
 library is being used. The vulnerability requires user interaction with the page to trigger. An attacker
 can exploit this issue by tricking a user into opening a malicious Vega specification. Successful
 exploitation allows the attacker to execute arbitrary JavaScript in the context of the application’s
 domain. This can lead to theft of sensitive information such as authentication tokens, manipulation of
 data displayed to the user, or execution of unauthorized actions on behalf of the victim. This exploit
 compromises confidentiality and integrity of impacted applications.Patched versions are available in
 `[email protected]` (requires ESM) for Vega v6 and `[email protected]` (no ESM needed) for Vega
 v5. As a workaround, do not attach `vega` or `vega.View` instances to global variables or the window as
 the editor used to do. This is a development-only debugging practice that should not be used in any
 situation where Vega/Vega-lite definitions can come from untrusted parties. (CVE-2025-65110)

See Also

https://github.com/advisories/GHSA-829q-m3qg-ph8r

Plugin Details

Severity: Critical

ID: 436577

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.8

Percentile: 96.94

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-65110

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/5/2026

Vulnerability Publication Date: 1/5/2026

Reference Information

CVE: CVE-2025-65110

cwe: CWE-79