Vaadin CVE-2026-91860

Exploitation requires the host application to merge an object it does not control into one of two specific sinks: a Vaadin chart configuration (e.g., via updateConfiguration/chart series config) or a Vaadin component's i18n property, both of which invoke the vulnerable deepMerge helper. The attacker must be able to supply a crafted object containing a __proto__ (or equivalent prototype) key that reaches that merge call. LIMITING FACTORS: this is not exploitable against a default configuration that never passes untrusted data into these merge functions (reflected by AT:P), impact is confined to client-side JavaScript integrity/availability (no confidentiality, no direct RCE absent a further gadget chain), and only the listed 23.x/24.x/25.x ranges below the fixed versions are affected while 10-13 and 15-22 are unsupported.

This is a client-side prototype pollution flaw (CWE-1321) in the deepMerge helpers of Vaadin Charts and Vaadin Component Base. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L, base 6.3) is internally consistent with the description: network-reachable, no privileges, no user interaction, but AT:P captures the key limiting factor - exploitation requires the host application to merge an attacker-controlled object into a chart configuration (updateConfiguration) or a component's i18n property. Impact is partial integrity and availability only (VI:L/VA:L), with no confidentiality impact, which is typical of prototype pollution that corrupts Object.prototype but does not directly disclose data. No EPSS score, KEV listing, or public exploit is provided in the input, so this is not confirmed to be under active exploitation. The source-code evidence (PR #12483 and siblings) confirms the root cause and fix - the old deepMerge copied keys such as __proto__ without filtering, and the new object-utils.js deepMerge/deepMergePartials plus a regression test ('should not copy the __proto__ key') validate the correction. Realistically this is a moderate-priority, defense-in-depth fix rather than an urgent RCE: real risk depends heavily on whether an application actually passes untrusted input into these merge sinks, and the impact is bounded to integrity/availability degradation of the front-end unless a downstream gadget chain escalates it.

An application feeds untrusted JSON (e.g., user-supplied chart settings or i18n overrides) into a Vaadin chart's updateConfiguration or a component's i18n property. An attacker submits a payload like {"__proto__": {"injected": "yes"}}, which the vulnerable deepMerge writes onto Object.prototype, making the injected property visible to every object in the running application. No public exploit was identified in the provided data, and successful exploitation depends on the application exposing one of these merge sinks to attacker-controlled data.