CVE-2025-66648

MediumCVSS 6.1/10Last modified Oct 14, 2026

Description

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-66659.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability i CVE-2025-66662.0A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionalit CVE-2025-666601.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to c CVE-2025-666644.6Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID CVE-2025-66678.8A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown function CVE-2025-666758.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-666766.2An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-666789.8An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu CVE-2025-66689.8A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-666807.1An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files v CVE-2025-666866.1A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges CVE-2025-666877.5Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files