EUVD-2026-107491Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Vaadin app
-
DeliverySubmit malicious chart data (series.keys / credits.href / markup)
-
ExploitData stored in chart configuration
-
ExecutionVictim renders or prints chart
-
ImpactScript executes or Object.prototype polluted in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the affected application to pass attacker-controlled data into the Highcharts chart configuration - specifically through Vaadin's additionalOptions, updateConfiguration(), or text options that accept markup. The concrete injectable sinks are: dotted paths in series.keys (prototype pollution via __proto__/constructor), credits.href (javascript:/vbscript:/data: scheme XSS), breadcrumbs.style, HTML text parsed during chart printing, and xlink:href attributes in exported charts (including the Node.js-based svg-generator/jsdom exporter). Limiting factors: an attacker must have an authenticated/low-privilege path to submit such data (PR:L), a victim must actively render, print, or export the affected chart (UI:A), and applications that only supply trusted/server-controlled chart data are not exploitable. The vulnerability cannot be remediated by upgrading Highcharts independently because Vaadin pins Highcharts 9.2.2 (Vaadin 22-24) / 12.2.0 (Vaadin 25); only the listed fixed Vaadin versions apply the mitigations. |
| Impact | This is a genuine but conditional web-application XSS/prototype-pollution issue rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N, base 8.4/High) indicates network-reachable, low-complexity exploitation that nonetheless requires some privilege (PR:L) and active victim interaction (UI:A), which matches CWE-79 client-side script execution. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the only 'source code' evidence present is Vaadin's own defensive patch (highcharts-patches.js), not weaponized exploit code. The decisive limiter is not the CVSS metrics but the exploitation precondition stated in the description: the application itself must route attacker-controlled data into the chart configuration (via additionalOptions, updateConfiguration(), or markup-accepting text options). Applications that only feed trusted/server-defined data into charts are effectively not exploitable, so real-world risk is highly deployment-dependent. Net: a real priority for teams that bind user-supplied data to Vaadin Charts, but lower practical risk than the 8.4 headline for the majority of deployments. |
| Exploit ScenarioDerived | An authenticated user of a Vaadin application submits data (e.g., a label, series key, or credits link) that the application passes unsanitized into a chart configuration via additionalOptions or updateConfiguration(). When a victim (such as an admin or another user) renders or prints that chart, the crafted credits.href/breadcrumbs.style/xlink:href or dotted series.keys path executes script in the victim's browser or pollutes Object.prototype. No public exploit code was identified at time of analysis, though the underlying Highcharts advisories (GHSA-rmqc-xvr3-v46c and related) document the techniques. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.
RemediationAI
Upgrade to a fixed Vaadin release: 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10 or 25.3.1 (or newer), which keeps the same bundled Highcharts version but applies Highsoft's recommended workarounds at load time; for the npm package the corresponding fixed versions are @vaadin/charts >=23.6.7, >=24.4.19, >=24.7.13, >=24.9.19, >=24.10.7, >=25.2.14 and >=25.3.1. Applications on Vaadin 10-13 or 15-22 must move to a supported line since no patch will be backported. Where an upgrade cannot be shipped immediately, the effective compensating control is input provenance: never let user-supplied data reach additionalOptions, updateConfiguration() or markup-bearing text options - server-side validate and allowlist chart options and strip __proto__/constructor keys and any javascript:, vbscript: or data: URLs (trade-off: legitimate custom chart markup must be pre-rendered or proxied); disable credits and breadcrumbs entirely when their text or links can be user-influenced; remove or restrict print and SVG-export endpoints to trusted roles (trade-off: loses a reporting feature for regular users); and run the Node.js svg-generator only on trusted configurations, ideally in a sandboxed process with a memory cap, because a successful prototype-pollution payload there persists for the process lifetime. A strict CSP without 'unsafe-inline' and with a restricted script-src limits the XSS sinks in the browser but does not fix the prototype-pollution issue, and upgrading Highcharts independently is not possible while Vaadin pins it. Advisory and patch references: https://vaadin.com/security/cve-2026-107588, https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c, GHSA-5793-x2q3-c3q7, GHSA-35rr-xwfh-x789, GHSA-65hg-cf3f-5m39, GHSA-mw4f-gj5x-6xr4 and GHSA-gfvx-2c2g-38wq.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vaadin Charts is the charting component of the Vaadin Flow and Vaadin web-components stacks; it renders through Highcharts, whose version Vaadin pins and ships as a bundled dependency, so the underlying library cannot be bumped by the consuming application. The flaw class is CWE-79 (improper neutralization of input during web page generation) with a prototype-pollution component: dotted paths in series.keys are resolved by Highcharts' nested-property setter, allowing __proto__ or constructor segments to write onto Object.prototype, while HTML/markup-bearing options (credits.href, breadcrumbs.style, text parsed by the print module, and xlink:href inside exported SVG) allow javascript:, vbscript: or data: schemes and event-handler attributes to survive into the DOM. The upstream fixes from Highsoft are published as GHSA-rmqc-xvr3-v46c, GHSA-5793-x2q3-c3q7, GHSA-35rr-xwfh-x789, GHSA-65hg-cf3f-5m39, GHSA-mw4f-gj5x-6xr4 and GHSA-gfvx-2c2g-38wq; Vaadin's patches (web-components PRs 12886-12918 and flow-components PR 10283) do not upgrade Highcharts but instead monkey-patch it at load time via Highcharts.wrap: Point.optionsToObject strips reserved keys, Point.setNestedProperty rejects __proto__/constructor path segments, Chart.addCredits deletes hrefs whose parsed protocol is javascript/vbscript/data, SVGElement._defaultSetter drops attributes beginning with 'on' (covering breadcrumbs.style-style attribute injection), and AST.filterUserAttributes removes xlink:href values outside AST.allowedReferences. The same patch module is required by the charts-flow SVG generator's jsdom-exporter.js, because that Node.js path renders server-side and has no browser CSP or DOM sanitizer protecting it, and a Trusted Types-aware policy hook (highcharts-policy.js) is used where available.
Know when Vaadin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Authenticated user injects data (PR:L), victim must render the chart (UI:R), and script executing in the victim's browser crosses a trust boundary (S:C) enabling high C/I impact; no availability effect.
Primary rating from Vendor (Vaadin).
CVSS VectorVendor: Vaadin
Lifecycle Timeline
2DescriptionCVE.org
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0
Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1
npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1
Articles & Coverage 1
Technical POC Analysis
The defect is not in Vaadin's Java code.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Vaadin Charts 22 through 25.3.0 can expose applications to browser-based script execution and prototype pollution when untrusted data reaches chart configuration, affecting users who render, print, or export charts and potentially the Node.js SVG export service. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but the affected Highcharts versions are pinned (9.2.2 in Vaadin 22-24 and 12.2.0 in Vaadin 25), so leadership should treat chart configuration as a controlled security boundary until Vaadin provides a fixed release.
No vendor-released patch identified at time of analysis. Interim controls: schema-validate and encode all chart configuration; prohibit untrusted input in additionalOptions, updateConfiguration(), and markup-bearing text options; reject dotted keys in series.keys; restrict credits.href, breadcrumbs.style, print-parsed HTML, and xlink:href to safe values; disable printing/export and Node.js SVG export where not required; enforce CSP; restrict chart configuration write access to trusted users; monitor Vaadin for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaad
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communica
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.1
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9),
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadi
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write a
Authentication bypass in Vaadin framework (14.0.0-14.14.0, 23.0.0-23.6.x, and other ranges). The web application framewo
Exploit-DB