---
id: 10275
title: "Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains"
cve: CVE-2025-59840
source_domain: lab.ctbb.show
source_url: "https://lab.ctbb.show/research/CVE-2025-59840-unusual-xss-technique-toString-gadget-chains"
published_at: "2025-12-01T00:00:00Z"
tags: ["xss", "gadget-chain", "vega", "cve-2025-59840"]
phying_url: "https://phying.com/item/10275"
lang: en
---

# Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains

## Summary

A writeup on the technical details of a Vega Visualization library XSS bug that uses interesting techniques to get controlled JS function execution.

## Intelligence Metadata

- **Sources:** lab.ctbb.show
- **CVE:** CVE-2025-59840
- **Published:** 2025-12-01T00:00:00Z
- **Original:** https://lab.ctbb.show/research/CVE-2025-59840-unusual-xss-technique-toString-gadget-chains
- **Phying News:** https://phying.com/item/10275