CVE-2025-65110: 
JavaScript vulnerability analysis and mitigation

CVE-2025-65110 is a DOM Cross-Site Scripting (XSS) vulnerability in the Vega visualization library, specifically within the vega-selections npm package, that allows arbitrary JavaScript execution even when Vega's "safe mode" expressionInterpreter is enabled. It affects vega-selections versions prior to 5.6.3 (Vega v5) and versions 6.0.0 through 6.1.1 (Vega v6). The vulnerability was published on January 5, 2026, by researcher hydrosquall via the GitHub Security Advisory GHSA-829q-m3qg-ph8r. The CVSS v3.1 base score is 8.1 (High) per the GitHub Advisory, while Feedly's estimate places it at 9.3 (Critical) due to a changed scope calculation (GitHub Advisory, Vega Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the selectionTuples implementation backing the vlSelectionTuples expression function. The vulnerability arises because vlSelectionTuples does not validate that its array argument is an actual array before calling .map() on it; an attacker can pass a crafted object with a map property set to a globally scoped "gadget function" (e.g., VEGA_DEBUG.vega.CanvasHandler.prototype.on). When Vega evaluates a user-supplied JSON specification containing a signal expression like vlSelectionTuples({map: event.view.VEGA_DEBUG.vega.CanvasHandler.prototype.on, ..., _handlerIndex: event.view.eval}), the gadget function is invoked with attacker-controlled arguments, ultimately calling window.eval with an arbitrary JavaScript payload. Two preconditions must be met: the application must expose the vega library and a vega.View instance (or equivalent gadgets) on the global window object, and it must accept user-defined Vega JSON specifications (GitHub Advisory, Vega Security Advisory).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the victim's browser within the application's domain context, bypassing Vega's intended expression sandboxing. This can result in theft of sensitive information including authentication tokens and session cookies, manipulation of data displayed to users, and execution of unauthorized actions on behalf of the victim (CSRF-like behavior). The vulnerability can manifest as stored XSS (if malicious specifications are persisted server-side) or reflected XSS (if specifications are passed via URL or other transient mechanisms), compromising both confidentiality and integrity of affected applications (GitHub Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, demonstrating exploitation via a crafted Vega JSON specification that triggers DOM XSS on mouse movement. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.025% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open or interact with a malicious Vega specification in a vulnerable application (GitHub Advisory, Vega Security Advisory).

1. Identify a vulnerable target: Find a web application using vega-selections < 5.6.3 or 6.0.0–6.1.1 that (a) exposes vega and vega.View on the global window object (e.g., via VEGA_DEBUG) and (b) accepts user-supplied Vega JSON specifications.
2. Craft a malicious Vega specification: Create a JSON specification that defines a signal with a mousemove event handler calling vlSelectionTuples with a crafted object. The object's map property is set to a gadget function from the global scope (e.g., event.view.VEGA_DEBUG.vega.CanvasHandler.prototype.on), eventName to event.view.console.log, _handlers to {undefined: '<payload>'}, and _handlerIndex to event.view.eval.
3. Embed the payload: The _handlers object contains the JavaScript payload string (e.g., alert(origin + ' XSS on version ' + VEGA_DEBUG.VEGA_VERSION)) that will be passed to eval.
4. Deliver the specification to the victim: Trick the user into loading the malicious specification in the vulnerable application — via a shared link, embedded content, or a stored specification if the application persists user-defined specs.
5. Trigger execution: When the victim moves their mouse over the Vega visualization, the mousemove event fires, vlSelectionTuples is called with the crafted object, the gadget function invokes window.eval with the payload string, and arbitrary JavaScript executes in the application's domain context (GitHub Advisory, Vega Security Advisory).

• Network: Unexpected outbound requests from the browser to attacker-controlled domains (e.g., for token exfiltration) originating from pages hosting Vega visualizations; unusual POST requests containing session tokens or cookies to external endpoints.
• Logs: Server-side access logs showing retrieval of unusual or externally-hosted Vega JSON specification files; application logs recording user-submitted Vega specs containing vlSelectionTuples with non-array arguments or references to VEGA_DEBUG, CanvasHandler, or eval.
• Browser/Client-Side: Unexpected eval calls or JavaScript errors in browser developer console related to Vega expression evaluation; DOM modifications inconsistent with the displayed visualization content.
• File System: If the application stores user-submitted Vega specs, presence of JSON files containing signal expressions with vlSelectionTuples, VEGA_DEBUG, _handlerIndex, or event.view.eval in the update field (GitHub Advisory).

Upgrade vega-selections to version 6.1.2 (requires ESM) for Vega v6, or to version 5.6.3 for Vega v5. The fix adds an Array.isArray(array) check in the selectionTuples implementation before calling .map(), preventing the gadget-chaining attack. As an immediate workaround, do not attach vega or vega.View instances to global variables or the window object — this is a development-only debugging practice that must not be used in production environments where Vega/Vega-Lite definitions can originate from untrusted parties (GitHub Advisory, Vega Security Advisory).

The vulnerability was reported by researcher nickcopi and published by hydrosquall via the Vega project's GitHub Security Advisory on January 5, 2026, with remediation credited to domoritz. Red Hat acknowledged the CVE in their security tracking system shortly after disclosure. The advisory received attention from automated vulnerability tracking platforms including Vulners, CVEFeed, and VulDB, as well as a technical write-up on infinitsec.net covering the XSS exploitation mechanism. Community discussion was noted on Bluesky and Mastodon/CIRCL vulnerability lookup feeds (Vega Security Advisory, Red Hat CVE).