CVE-2025-14896 - Vega Remote File Inclusion Vulnerability

CVE ID : CVE-2025-14896 Published : Dec. 18, 2025, 5:15 p.m. | 30 minutes ago Description : due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor