Vaadin Charts Flow Svg Generator
Monthly
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.