CVE-2025-25304: Vega Visualization Grammar XSS Vulnerability

CVE-2025-25304 Overview

CVE-2025-25304 is a cross-site scripting (XSS) vulnerability in Vega, a visualization grammar used to create declarative interactive visualization designs. The flaw resides in the vlSelectionTuples function within the vega-selections package. An attacker can leverage this function to invoke Function() with attacker-controlled JavaScript, then trigger execution through vlSelectionTuples itself or via type coercion using toString or valueOf. The issue affects vega versions prior to 5.26.0 and vega-selections versions prior to 5.4.2. The vulnerability is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of any application embedding vulnerable Vega visualizations, enabling session hijacking, data theft, and UI redress.

Affected Products

vega versions prior to 5.26.0
vega-selections versions prior to 5.4.2
Applications embedding vulnerable Vega/Vega-Lite visualizations that process untrusted specifications

Discovery Timeline

2025-02-14 - CVE-2025-25304 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25304

Vulnerability Analysis

The vlSelectionTuples function in packages/vega-selections/src/selectionTuples.js maps scene graph items to selection tuples for Vega-Lite selection resolution. During this mapping, the function calls multiple helper routines that operate on attacker-controllable arguments. One of these calls accepts a value that can be coerced into the Function() constructor, producing a JavaScript function object from attacker-supplied source. Once constructed, that function is invoked either directly by vlSelectionTuples or indirectly when the object is coerced to a primitive through toString or valueOf. Because Vega specifications are frequently rendered inside dashboards, notebooks, and web applications, the resulting execution occurs in the origin of the hosting page.

Root Cause

The root cause is unsafe use of a field accessor built from selection tuple metadata. Prior to the patch, vega-util's field helper was used to construct property accessors from strings that could originate in the visualization specification. When those strings contained JavaScript expressions, the underlying implementation permitted arbitrary code compilation. The maintainers replaced this with a constrained getter utility that resolves properties without dynamic function construction.

Attack Vector

Exploitation requires the target application to render a Vega or Vega-Lite specification supplied, wholly or partially, by an attacker. This scenario is common in analytics platforms, notebook services, and reporting tools that accept user-submitted charts. No authentication or user interaction beyond viewing the rendered chart is required.

javascript

// Security patch in packages/vega-selections/src/selectionTuples.js
// Source: https://github.com/vega/vega/commit/9fb9ea07e27984394e463d286eb73944fa61411e
-import {extend, field} from 'vega-util';
-import {$selectionId, SelectionId} from './constants';
+import {extend} from 'vega-util';
+import {$selectionId, SelectionId, getter} from './util';

/**
 * Maps an array of scene graph items to an array of selection tuples.
 */

The fix removes the field import from vega-util and switches to an internal getter in a new util module, eliminating the dynamic function construction path. See the GHSA-mp7w-mhcv-673j advisory for full details.

Detection Methods for CVE-2025-25304

Indicators of Compromise

Vega or Vega-Lite specifications containing unusual field expressions with parentheses, backticks, or Function references
Outbound requests from browser sessions viewing user-submitted visualizations to unexpected domains
Unexpected DOM modifications or script execution originating from chart rendering containers

Detection Strategies

Inventory front-end dependencies and flag builds pinning vega below 5.26.0 or vega-selections below 5.4.2 in package-lock.json or yarn.lock.
Add server-side validation of user-supplied Vega specifications, rejecting field expressions containing executable JavaScript syntax.
Enable a strict Content Security Policy (CSP) that forbids unsafe-eval, which blocks the Function() constructor path used by this vulnerability.

Monitoring Recommendations

Log and review server-side ingestion of Vega/Vega-Lite specifications, alerting on payloads that contain long inline expressions or JavaScript keywords.
Monitor browser telemetry and CSP violation reports for script-srcunsafe-eval violations tied to visualization rendering routes.
Track software composition analysis (SCA) output for continued exposure to the vulnerable package versions across build pipelines.

How to Mitigate CVE-2025-25304

Immediate Actions Required

Upgrade vega to version 5.26.0 or later and vega-selections to version 5.4.2 or later across all applications and shared libraries.
Rebuild and redeploy any bundled front-end assets that transitively include the vulnerable packages.
Audit stored Vega specifications from untrusted sources and re-render them only after the patched versions are in production.

Patch Information

The fix is committed in vega commit 9fb9ea07 and shipped in vega 5.26.0 and vega-selections 5.4.2. The patch replaces the field helper with an internal getter and moves selection constants into a util module, closing the dynamic Function() construction path.

Workarounds

Enforce a Content Security Policy that omits unsafe-eval from script-src, which prevents Function() compilation used by the exploit.
Restrict Vega specification input to trusted authors, or sanitize incoming specifications to reject field expressions containing JavaScript syntax.
Render untrusted visualizations inside a sandboxed iframe with a distinct origin to contain any residual script execution.

bash

# Upgrade vulnerable packages to fixed versions
npm install vega@^5.26.0 vega-selections@^5.4.2
npm audit --production