CVE-2025-14896 — due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will all — CVE Database · The Intelligence Room