Multiple flaws in Highcharts bundled with Vaadin Charts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Vaadin Charts bundles the Highcharts library at a pinned version, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so upgrading Highcharts alone does not remove these flaws. Dotted series.keys paths can write to Object.prototype (CWE-1321), and several options cause cross-site scripting (CWE-79), including credits.href, breadcrumbs.style, HTML text parsed while printing, and xlink:href in exported charts. An attacker with low privileges can trigger them when data they control reaches the chart configuration, for example through additionalOptions or updateConfiguration().
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 22.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.16; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 | 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, 25.3.1 | Patch available | CNA |
| Vaadin | vaadin-charts-flow | 22.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.15; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 | 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 | Patch available | CNA |
| Vaadin | vaadin-charts-flow-svg-generator | 21.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.15; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 | 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 | Patch available | CNA |
| Vaadin | @vaadin/charts | 22.0.0 to before 23.6.7; 24.0.0 to before 24.4.19; 24.5.0 to before 24.7.13; 24.8.0 to before 24.9.19; 24.10.0 to before 24.10.7; 25.0.0 – 25.0.13; 25.1.0 – 25.1.14; 25.2.0 to before 25.2.14; 25.3.0 to before 25.3.1 | 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14, 25.3.1 | Patch available | CNA |
- vaadin VendorVaadin Affected 22.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.16; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 Fixed in 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, 25.3.1 Patch available CNA
- vaadin-charts-flow VendorVaadin Affected 22.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.15; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 Fixed in 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 Patch available CNA
- vaadin-charts-flow-svg-generator VendorVaadin Affected 21.0.0 to before 23.6.16; 24.0.0 to before 24.4.24; 24.5.0 to before 24.7.15; 24.8.0 to before 24.9.23; 24.10.0 to before 24.10.11; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.10; 25.3.0 to before 25.3.1 Fixed in 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 Patch available CNA
- @vaadin/charts VendorVaadin Affected 22.0.0 to before 23.6.7; 24.0.0 to before 24.4.19; 24.5.0 to before 24.7.13; 24.8.0 to before 24.9.19; 24.10.0 to before 24.10.7; 25.0.0 – 25.0.13; 25.1.0 – 25.1.14; 25.2.0 to before 25.2.14; 25.3.0 to before 25.3.1 Fixed in 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14, 25.3.1 Patch available CNA
Remediation
Upgrade vaadin to 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10 or 25.3.1, vaadin-charts-flow and vaadin-charts-flow-svg-generator to 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10 or 25.3.1, and @vaadin/charts to 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14 or 25.3.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA vaadin (vaadin) Fixed in 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, 25.3.1
- Fix · CNA vaadin-charts-flow (vaadin) Fixed in 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1
- Fix · CNA vaadin-charts-flow-svg-generator (vaadin) Fixed in 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1
- Fix · CNA @vaadin/charts (vaadin) Fixed in 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14, 25.3.1
Vendor assessments
Timeline
- 2026-10-21 Threatist record created from CVE-2026-107588
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 25
- https://vaadin.com/security/cve-2026-107588
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c
- https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7
- https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789
- https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
- https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
- https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq
- https://github.com/vaadin/web-components/pull/12886
- https://github.com/vaadin/web-components/pull/12887
- https://github.com/vaadin/web-components/pull/12897
- https://github.com/vaadin/web-components/pull/12898
- https://github.com/vaadin/web-components/pull/12899
- https://github.com/vaadin/web-components/pull/12900
- https://github.com/vaadin/web-components/pull/12901
- https://github.com/vaadin/web-components/pull/12918
- https://github.com/vaadin/web-components/pull/12919
- https://github.com/vaadin/flow-components/pull/10283
- https://github.com/vaadin/flow-components/pull/10284
- https://github.com/vaadin/flow-components/pull/10285
- https://github.com/vaadin/flow-components/pull/10290
- https://github.com/vaadin/flow-components/pull/10291
- https://github.com/vaadin/flow-components/pull/10292
- https://github.com/vaadin/flow-components/pull/10293
- https://github.com/vaadin/flow-components/pull/10299
- https://github.com/vaadin/flow-components/pull/10300
More Vaadin vulnerabilities
- TI-2026-81073 Vaadin push endpoint reflects any Origin and allows credentials CVSS 4.0LOW 2.3
- TI-2026-78950 Session lock leak in Vaadin Framework 8 allows denial of service CVSS 4.0HIGH 8.7
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
- TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-107588 · CVE Program
- CVE-2026-107588 · NVD
- FIRST EPSS
- CVE-2026-107588 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences