High severity7.5OSV Advisory· Published Dec 18, 2025· Updated Apr 15, 2026
CVE-2025-14896
CVE-2025-14896
Description
due to insufficient sanitazation in Vega’s convert() function when safeMode is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.
Affected products
1Patches
1f31093cd8a0aVulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.