[From nobody Sun Apr 5 20:51:05 2026 Received: (at submit) by bugs.debian.org; 10 Jan 2026 13:00:11 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, KHOP_HELO_FCRDNS,RDNS_DYNAMIC,SPF_HELO_NONE,SPF_NONE,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 29; hammy, 149; neutral, 132; spammy, 1. spammytokens:0.995-+--designs hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: from c-82-192-244-13.customer.ggaweb.ch ([82.192.244.13]:52900 helo=eldamar.lan) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1veYZd-00Euqp-1Q for submit@bugs.debian.org; Sat, 10 Jan 2026 13:00:10 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: vega.js: CVE-2025-65110 Message-ID: <176805000838.165037.1700181457197794092.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Sat, 10 Jan 2026 14:00:08 +0100 Delivered-To: submit@bugs.debian.org U291cmNlOiB2ZWdhLmpzClZlcnNpb246IDUuMjguMCtkcyt+Y3M1LjMuMC0xClNldmVyaXR5OiBp bXBvcnRhbnQKVGFnczogc2VjdXJpdHkgdXBzdHJlYW0KWC1EZWJidWdzLUNjOiBjYXJuaWxAZGVi aWFuLm9yZywgRGViaWFuIFNlY3VyaXR5IFRlYW0gPHRlYW1Ac2VjdXJpdHkuZGViaWFuLm9yZz4K CkhpLAoKVGhlIGZvbGxvd2luZyB2dWxuZXJhYmlsaXR5IHdhcyBwdWJsaXNoZWQgZm9yIHZlZ2Eu anMuCgpDVkUtMjAyNS02NTExMFswXToKfCBWZWdhIGlzIGEgdmlzdWFsaXphdGlvbiBncmFtbWFy LCBhIGRlY2xhcmF0aXZlIGZvcm1hdCBmb3IgY3JlYXRpbmcsCnwgc2F2aW5nLCBhbmQgc2hhcmlu ZyBpbnRlcmFjdGl2ZSB2aXN1YWxpemF0aW9uIGRlc2lnbnMuIFByaW9yIHRvCnwgdmVyc2lvbnMg Ni4xLjIgYW5kIDUuNi4zLCBhcHBsaWNhdGlvbnMgbWVldGluZyB0d28gY29uZGl0aW9ucyBhcmUg YXQKfCByaXNrIG9mIGFyYml0cmFyeSBKYXZhU2NyaXB0IGNvZGUgZXhlY3V0aW9uLCBldmVuIGlm ICJzYWZlIG1vZGUiCnwgZXhwcmVzc2lvbkludGVycHJldGVyIGlzIHVzZWQuIEZpcnN0LCB0aGV5 IHVzZSBgdmVnYWAgaW4gYW4KfCBhcHBsaWNhdGlvbiB0aGF0IGF0dGFjaGVzIGJvdGggYHZlZ2Fg IGxpYnJhcnkgYW5kIGEgYHZlZ2EuVmlld2AKfCBpbnN0YW5jZSBzaW1pbGFyIHRvIHRoZSBWZWdh IEVkaXRvciB0byB0aGUgZ2xvYmFsIGB3aW5kb3dgLCBvciBoYXMKfCBhbnkgb3RoZXIgc2F0aXNm YWN0b3J5IGZ1bmN0aW9uIGdhZGdldHMgaW4gdGhlIGdsb2JhbCBzY29wZS4gU2Vjb25kLAp8IHRo ZXkgYWxsb3cgdXNlci1kZWZpbmVkIFZlZ2EgYEpTT05gIGRlZmluaXRpb25zICh2cyBKU09OIHRo YXQgd2FzIGlzCnwgb25seSBwcm92aWRlZCB0aHJvdWdoIHNvdXJjZSBjb2RlKS4gVGhpcyB2dWxu ZXJhYmlsaXR5IGFsbG93cyBmb3IKfCBET00gWFNTLCBwb3RlbnRpYWxseSBzdG9yZWQsIHBvdGVu dGlhbGx5IHJlZmxlY3RlZCwgZGVwZW5kaW5nIG9uIGhvdwp8IHRoZSBsaWJyYXJ5IGlzIGJlaW5n IHVzZWQuIFRoZSB2dWxuZXJhYmlsaXR5IHJlcXVpcmVzIHVzZXIKfCBpbnRlcmFjdGlvbiB3aXRo IHRoZSBwYWdlIHRvIHRyaWdnZXIuIEFuIGF0dGFja2VyIGNhbiBleHBsb2l0IHRoaXMKfCBpc3N1 ZSBieSB0cmlja2luZyBhIHVzZXIgaW50byBvcGVuaW5nIGEgbWFsaWNpb3VzIFZlZ2EKfCBzcGVj aWZpY2F0aW9uLiBTdWNjZXNzZnVsIGV4cGxvaXRhdGlvbiBhbGxvd3MgdGhlIGF0dGFja2VyIHRv CnwgZXhlY3V0ZSBhcmJpdHJhcnkgSmF2YVNjcmlwdCBpbiB0aGUgY29udGV4dCBvZiB0aGUgYXBw bGljYXRpb27igJlzCnwgZG9tYWluLiBUaGlzIGNhbiBsZWFkIHRvIHRoZWZ0IG9mIHNlbnNpdGl2 ZSBpbmZvcm1hdGlvbiBzdWNoIGFzCnwgYXV0aGVudGljYXRpb24gdG9rZW5zLCBtYW5pcHVsYXRp b24gb2YgZGF0YSBkaXNwbGF5ZWQgdG8gdGhlIHVzZXIsCnwgb3IgZXhlY3V0aW9uIG9mIHVuYXV0 aG9yaXplZCBhY3Rpb25zIG9uIGJlaGFsZiBvZiB0aGUgdmljdGltLiBUaGlzCnwgZXhwbG9pdCBj b21wcm9taXNlcyBjb25maWRlbnRpYWxpdHkgYW5kIGludGVncml0eSBvZiBpbXBhY3RlZAp8IGFw cGxpY2F0aW9ucy5QYXRjaGVkIHZlcnNpb25zIGFyZSBhdmFpbGFibGUgaW4gYHZlZ2EtCnwgc2Vs ZWN0aW9uc0A2LjEuMmAgKHJlcXVpcmVzIEVTTSkgZm9yIFZlZ2EgdjYgYW5kIGB2ZWdhLQp8IHNl bGVjdGlvbnNANS42LjNgIChubyBFU00gbmVlZGVkKSBmb3IgVmVnYSB2NS4gQXMgYSB3b3JrYXJv dW5kLCBkbwp8IG5vdCBhdHRhY2ggYHZlZ2FgIG9yIGB2ZWdhLlZpZXdgIGluc3RhbmNlcyB0byBn bG9iYWwgdmFyaWFibGVzIG9yCnwgdGhlIHdpbmRvdyBhcyB0aGUgZWRpdG9yIHVzZWQgdG8gZG8u IFRoaXMgaXMgYSBkZXZlbG9wbWVudC1vbmx5CnwgZGVidWdnaW5nIHByYWN0aWNlIHRoYXQgc2hv dWxkIG5vdCBiZSB1c2VkIGluIGFueSBzaXR1YXRpb24gd2hlcmUKfCBWZWdhL1ZlZ2EtbGl0ZSBk ZWZpbml0aW9ucyBjYW4gY29tZSBmcm9tIHVudHJ1c3RlZCBwYXJ0aWVzLgoKCklmIHlvdSBmaXgg dGhlIHZ1bG5lcmFiaWxpdHkgcGxlYXNlIGFsc28gbWFrZSBzdXJlIHRvIGluY2x1ZGUgdGhlCkNW RSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykgaWQgaW4geW91ciBjaGFuZ2Vs b2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZvcm1hdGlvbiBzZWU6CgpbMF0gaHR0cHM6Ly9zZWN1 cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAyNS02NTExMAogICAgaHR0cHM6 Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjUtNjUxMTAKWzFdIGh0dHBzOi8vZ2l0 aHViLmNvbS92ZWdhL3ZlZ2Evc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLTgyOXEtbTNxZy1waDhy CgpQbGVhc2UgYWRqdXN0IHRoZSBhZmZlY3RlZCB2ZXJzaW9ucyBpbiB0aGUgQlRTIGFzIG5lZWRl ZC4KClJlZ2FyZHMsClNhbHZhdG9yZQo= ]