Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7 npm packages npm package Vulnerable versions Fixed version @vaadin/charts 23.0.0 - 23.6.4 >=23.6.5 @vaadin/charts 24.0.0 - 24.9.17 >=24.9.18 @vaadin/charts 24.10.0 - 24.10.4 >=24.10.5 @vaadin/charts 25.0.0 - 25.1.11 >=25.1.12 @vaadin/charts 25.2.0 - 25.2.8 >=25.2.9 @vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18 @vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5 @vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12 @vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 23.0.0 to before 23.6.14; 24.0.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 | 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 | Patch available | CNA |
| Vaadin | vaadin-core | 24.7.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 | 24.9.21, 24.10.10, 25.1.12, 25.2.7 | Patch available | CNA |
| Vaadin | vaadin-charts-flow | 23.0.0 to before 23.6.14; 24.0.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 | 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 | Patch available | CNA |
| Vaadin | @vaadin/charts | 23.0.0 to before 23.6.5; 24.0.0 to before 24.9.18; 24.10.0 to before 24.10.5; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.9 | 23.6.5, 24.9.18, 24.10.5, 25.1.12, 25.2.9 | Patch available | CNA |
| Vaadin | @vaadin/component-base | 24.7.0 to before 24.9.18; 24.10.0 to before 24.10.5; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.9 | 24.9.18, 24.10.5, 25.1.12, 25.2.9 | Patch available | CNA |
- vaadin VendorVaadin Affected 23.0.0 to before 23.6.14; 24.0.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 Fixed in 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 Patch available CNA
- vaadin-core VendorVaadin Affected 24.7.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 Fixed in 24.9.21, 24.10.10, 25.1.12, 25.2.7 Patch available CNA
- vaadin-charts-flow VendorVaadin Affected 23.0.0 to before 23.6.14; 24.0.0 to before 24.9.21; 24.10.0 to before 24.10.10; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.7 Fixed in 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 Patch available CNA
- @vaadin/charts VendorVaadin Affected 23.0.0 to before 23.6.5; 24.0.0 to before 24.9.18; 24.10.0 to before 24.10.5; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.9 Fixed in 23.6.5, 24.9.18, 24.10.5, 25.1.12, 25.2.9 Patch available CNA
- @vaadin/component-base VendorVaadin Affected 24.7.0 to before 24.9.18; 24.10.0 to before 24.10.5; 25.0.0 to before 25.1.12; 25.2.0 to before 25.2.9 Fixed in 24.9.18, 24.10.5, 25.1.12, 25.2.9 Patch available CNA
Remediation
- Fix · CNA vaadin (vaadin) Fixed in 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7
- Fix · CNA vaadin-core (vaadin) Fixed in 24.9.21, 24.10.10, 25.1.12, 25.2.7
- Fix · CNA vaadin-charts-flow (vaadin) Fixed in 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7
- Fix · CNA @vaadin/charts (vaadin) Fixed in 23.6.5, 24.9.18, 24.10.5, 25.1.12, 25.2.9
- Fix · CNA @vaadin/component-base (vaadin) Fixed in 24.9.18, 24.10.5, 25.1.12, 25.2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-91860
- 2026-10-03 Alias added: GHSA-48v4-h5mw-72ww
References
Other 7
- https://vaadin.com/security/cve-2026-91860
- https://github.com/vaadin/web-components/pull/12483
- https://github.com/vaadin/web-components/pull/12492
- https://github.com/vaadin/web-components/pull/12493
- https://github.com/vaadin/web-components/pull/12494
- https://github.com/vaadin/web-components/pull/12496
- https://github.com/vaadin/web-components/pull/12559
More Vaadin vulnerabilities
- TI-2026-81073 Vaadin push endpoint reflects any Origin and allows credentials CVSS 4.0LOW 2.3
- TI-2026-78950 Session lock leak in Vaadin Framework 8 allows denial of service CVSS 4.0HIGH 8.7
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
- TI-2026-78949 Multiple flaws in Highcharts bundled with Vaadin Charts CVSS 4.0HIGH 8.4
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-91860 · CVE Program
- CVE-2026-91860 · NVD
- FIRST EPSS
- GHSA-48v4-h5mw-72ww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences