CVE-2025-59840: Critical JavaScript Execution Vulnerability in Vega Visualization Library

Overview

CVE-2025-59840 is a high-severity vulnerability affecting the Vega visualization grammar library. This vulnerability allows for arbitrary JavaScript code execution in specific scenarios, even when the “safe mode” expressionInterpreter is enabled. This poses a significant risk to applications using Vega that allow user-defined Vega JSON definitions.

Technical Details

The vulnerability exists in Vega versions prior to 6.2.0. Applications are susceptible if they meet the following conditions:

• The application uses the vega library and attaches both the vega library and a vega.View instance to the global window object (similar to the Vega Editor setup).
• The application allows users to define Vega JSON definitions (as opposed to only using JSON provided through source code).

By crafting malicious Vega JSON, an attacker can leverage this vulnerability to execute arbitrary JavaScript code within the context of the affected application. This can lead to various security breaches, including data theft, system compromise, and denial-of-service attacks.

CVSS Analysis

• CVE ID: CVE-2025-59840
• Severity: HIGH
• CVSS Score: 8.1

Possible Impact

Successful exploitation of CVE-2025-59840 can have severe consequences:

• Arbitrary Code Execution: An attacker can execute arbitrary JavaScript code on the server or client-side, depending on where the Vega visualization is processed.
• Data Theft: Sensitive data can be accessed and exfiltrated by the attacker.
• System Compromise: The attacker could potentially gain control of the entire system.
• Denial of Service: The attacker could disrupt the availability of the application.

Mitigation and Patch Steps

The recommended mitigation is to upgrade to a patched version of the Vega library:

• Vega 6.x Line: Upgrade to vega version 6.2.0 or later, vega-expression version 6.1.0 or later, and vega-interpreter version 2.2.1 or later (if using AST evaluator mode).
• Non-ESM Environment: Upgrade to vega-expression version 5.2.1 or later and/or 1.2.1 or later (if using AST evaluator mode).

If upgrading is not immediately feasible, consider the following workarounds:

• Avoid Global Variables: Do not attach vega.View instances to global variables.
• Avoid Global Vega Attachment: Do not attach the vega library to the global window object.

Attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.

References

• GitHub Security Advisory: GHSA-7f2v-3qq3-vvjf