Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

CVE-2026-91860

Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
30/09/2026
Last modified:
30/09/2026

Description

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component&amp;#39;s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.<br /> <br /> <br /> Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<br /> <br /> Product version<br /> Vaadin 23.0.0 - 23.6.13<br /> Vaadin 24.0.0 - 24.9.20<br /> Vaadin 24.10.0 - 24.10.9<br /> Vaadin 25.0.0 - 25.1.11<br /> Vaadin 25.2.0 - 25.2.6<br /> <br /> Mitigation<br /> Upgrade to 23.6.14<br /> Upgrade to 24.9.21<br /> Upgrade to 24.10.10<br /> Upgrade to 25.1.12<br /> Upgrade to 25.2.7 or newer<br /> <br /> Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<br /> <br /> Artifacts<br /> Maven coordinates Vulnerable versions Fixed version<br /> com.vaadin:vaadin 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-core 24.7.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-core 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-core 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-core 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 &gt;=25.2.7<br /> <br /> npm packages<br /> npm package Vulnerable versions Fixed version<br /> @vaadin/charts 23.0.0 - 23.6.4 &gt;=23.6.5<br /> @vaadin/charts 24.0.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/charts 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/charts 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/charts 25.2.0 - 25.2.8 &gt;=25.2.9<br /> @vaadin/component-base 24.7.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/component-base 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/component-base 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/component-base 25.2.0 - 25.2.8 &gt;=25.2.9

Impact

Vector 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS v4.0 Severity and Metrics:

Base Score: 6.30 MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): None
User Interaction (UI): None
Confidentiality (VC): None
Integrity (VI): Low
Availability (VA): Low
Confidentiality (SC): None
Integrity (SI): None
Availability (SA): None

Base Score 4.0
6.30
Severity 4.0
MEDIUM

References to Advisories, Solutions, and Tools