Read the docs
TI-2021-12987 Aliases CVE-2021-33604GHSA-c99r-67x4-whj6

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Priority LOW 13CWE-172Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Why it matters now

EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed com.vaadin:vaadin-bom (Maven): 14.6.2, 19.0.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VaadinVaadin14.0.0 and later; up to 14.6.1; 15.0.0 and later; up to 19.0.8—No fix listedCNA
Vaadinflow-server2.0.0 and later; up to 2.6.1; 3.0.0 and later; up to 6.0.9—No fix listedCNA
—com.vaadin:vaadin-bom (Maven)14.0.0 to before 14.6.214.6.2Patch availableGHSA-c99r-67x4-whj6
—com.vaadin:vaadin-bom (Maven)15.0.0 to before 19.0.919.0.9Patch availableGHSA-c99r-67x4-whj6
  • Vaadin VendorVaadin Affected 14.0.0 and later; up to 14.6.1; 15.0.0 and later; up to 19.0.8 Fixed in — No fix listed CNA
  • flow-server VendorVaadin Affected 2.0.0 and later; up to 2.6.1; 3.0.0 and later; up to 6.0.9 Fixed in — No fix listed CNA
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 14.0.0 to before 14.6.2 Fixed in 14.6.2 Patch available GHSA-c99r-67x4-whj6
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 15.0.0 to before 19.0.9 Fixed in 19.0.9 Patch available GHSA-c99r-67x4-whj6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*2.0.0 – 2.6.1; 3.0.0 – 5.0.0; 6.0.0 – 6.0.9VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*14.0.0 – 14.6.1; 15.0.0 – 18.0.0; 19.0.0 – 19.0.8VulnerableVaadin
  • cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.6.1; 3.0.0 – 5.0.0; 6.0.0 – 6.0.9 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.6.1; 15.0.0 – 18.0.0; 19.0.0 – 19.0.8 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-c99r-67x4-whj6 com.vaadin:vaadin-bom (Maven) Fixed in 14.6.2 Advisory →
  • Fix · GHSA-c99r-67x4-whj6 com.vaadin:vaadin-bom (Maven) Fixed in 19.0.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33604
  2. 2026-10-03 Alias added: GHSA-c99r-67x4-whj6

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences