PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains

lab.ctbb.show | research | CVE-2025-59840 | #xss | #gadget-chain | #vega | #cve-2025-59840
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A writeup on the technical details of a Vega Visualization library XSS bug that uses interesting techniques to get controlled JS function execution.
CVE
CVE-2025-59840
Published
Collected

Related coverage

research · lab.ctbb.show
Total.js RCE gadgets all around
RCEs, RCEs…they are all around and Total.js framework will be in our scope this time
research · lab.ctbb.show
Challenge Two - Stranger XSS
The second challenge of an XSS miniseries leading up to a writeup on a bug in an open source library.
research · lab.ctbb.show
Challenge One - Strange XSS
A cool challenge introducing an XSS miniseries leading up to a writeup on a bug in an open source library.
research · lab.ctbb.show
Exploiting Web Worker XSS with Blobs
Ways to turn XSS in a Web Worker into full XSS, covering known tricks and a new generic exploit using Blob URLs with the Drag and Drop API
research · blog.trailofbits.com
Marshal madness: A brief history of Ruby deserialization exploits
A decade-long history of Ruby Marshal deserialization exploits shows researchers repeatedly bypassing patches, arguing for fundamental ecosystem changes rather than a patch-and-hope approach.
research · yokai.hakaisecurity.io
Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta
# Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta RESEARCHER **Pedro Cruz "gankd"** READ TIME**12 MINUTES** PUBLISHED**15 Oct 2026** INDEX ▸ Sumário ▸ Introdução ▸...
Back