CVE-2025-66648: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66648 is a Cross-Site Scripting (XSS) vulnerability in the vega-functions npm package, which provides function implementations for the Vega visualization expression language. An attacker can exploit an internal modify() function (not part of the public API) — invoked via the setdata expression — to execute arbitrary JavaScript in the context of a victim's browser on sites that accept untrusted user input. All versions up to and including 6.1.0 are affected; the issue was fixed in version 6.1.1. Disclosed on January 5, 2026, it carries a CVSS v3.1 base score of 7.2 (High) per the GitHub Security Advisory, though NVD records a score of 6.1 (Medium) with user interaction required (GitHub Advisory, Vega Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically within the modify() function used internally by setdata in the Vega expression language. Because modify() allows an attacker to control both the method called and the values supplied, a malicious Vega specification can reference event.dataflow._el.ownerDocument.defaultView.alert (or any other DOM method) as the callable, effectively bridging the Vega expression sandbox to the browser's window object. The attack requires the application to render attacker-controlled Vega specifications, and notably, using vega.expressionInterpreter in CSP safe mode does not mitigate the issue. A public proof-of-concept payload was included in the advisory (Vega Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, enabling theft of session cookies, credentials, or other sensitive data accessible via the DOM (including document.domain and document.cookie). The vulnerability's scope is marked as "Changed," meaning the impact extends beyond the vulnerable component itself to the broader browser context. IBM Guardium Data Security Center (both cloud and on-premises variants) is also listed as an affected product, broadening the potential enterprise impact (Vega Advisory, IBM Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating cookie and domain exfiltration via a crafted Vega specification (Vega Advisory). The EPSS score is approximately 0.029% (9th percentile), indicating a low but non-zero probability of exploitation in the near term (GitHub Advisory). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog.

1. Identify a target application: Find a web application that renders user-supplied or externally sourced Vega specifications using vega-functions version ≤ 6.1.0 (e.g., dashboards, data visualization tools, or BI platforms).
2. Craft a malicious Vega specification: Construct a Vega JSON spec that uses a signals block with a timer event to trigger the setdata and modify() expressions, passing a reference to a DOM method (e.g., event.dataflow._el.ownerDocument.defaultView.alert) as the callable argument to modify().
3. Inject the payload: Submit the malicious Vega spec to the target application through any input channel that results in it being rendered — e.g., a shared dashboard link, an uploaded spec file, or an API parameter.
4. Trigger execution: When a victim user views the rendered visualization, the timer event fires after the configured throttle period (e.g., 2000ms), causing modify() to invoke the attacker-controlled function with attacker-controlled arguments.
5. Exfiltrate data: The executed JavaScript can read document.cookie, document.domain, or other sensitive DOM properties and exfiltrate them to an attacker-controlled server via fetch() or XMLHttpRequest.

Example PoC payload (from the advisory):

{
  "$schema": "https://vega.github.io/schema/vega/v6.json",
  "data": [{"name": "table", "values": [{"category": "A", "amount": 28}]}],
  "signals": [{
    "name": "tooltip", "value": {},
    "on": [{
      "events": {"type": "timer", "throttle": 2000},
      "update": "setdata('table',[['Domain: '+event.dataflow._el.ownerDocument.domain+' , cookies: '+ event.dataflow._el.ownerDocument.cookie]])+warn('XSS is here', modify('table',2,3,null,event.dataflow._el.ownerDocument.defaultView.alert,{'tttt':'yyyy'}))"
    }]
  }]
}

(Vega Advisory)

• Network: Unexpected outbound HTTP requests from the browser to unknown external domains shortly after loading a Vega visualization; requests containing URL-encoded cookie or session data in query parameters or POST bodies.
• Logs: Web server or CDN access logs showing delivery of Vega specification files or API responses containing modify(, setdata(, or references to event.dataflow._el.ownerDocument in expression strings.
• File System / Application: Vega specification files or database records containing expressions referencing defaultView, ownerDocument, document.cookie, or document.domain within signals[].on[].update fields.
• Browser: Unexpected JavaScript alert() dialogs or console warnings (e.g., warn('XSS is here', ...)) appearing when viewing Vega-based visualizations.

The only remediation is to upgrade vega-functions to version 6.1.1 or later, which patches the internal modify() function to prevent attacker-controlled method invocation (Vega Advisory). There is no configuration-based workaround; in particular, using vega.expressionInterpreter in CSP safe mode does not prevent exploitation. Organizations using IBM Guardium Data Security Center should also apply the relevant IBM security bulletin patches (IBM Advisory). Applications that accept user-supplied Vega specifications should additionally implement strict input validation and consider sandboxing the rendering environment.

The vulnerability was reported by researcher nikolaybabiy and remediated by hydrosquall (developer) and domoritz (reviewer) within the Vega project (Vega Advisory). A technical write-up titled "CVE-2025-66648: Vega's Visual Betrayal — Leaking the Window via Internal Functions" was published on Dev.to, providing additional analysis of the exploitation mechanism (Dev.to Write-up). IBM issued a security bulletin acknowledging the impact on Guardium Data Security Center (IBM Advisory).