CVE-2026-91860

*** Pendiente de traducción *** A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component&amp;#39;s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.<br /> <br /> <br /> Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<br /> <br /> Product version<br /> Vaadin 23.0.0 - 23.6.13<br /> Vaadin 24.0.0 - 24.9.20<br /> Vaadin 24.10.0 - 24.10.9<br /> Vaadin 25.0.0 - 25.1.11<br /> Vaadin 25.2.0 - 25.2.6<br /> <br /> Mitigation<br /> Upgrade to 23.6.14<br /> Upgrade to 24.9.21<br /> Upgrade to 24.10.10<br /> Upgrade to 25.1.12<br /> Upgrade to 25.2.7 or newer<br /> <br /> Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<br /> <br /> Artifacts<br /> Maven coordinates Vulnerable versions Fixed version<br /> com.vaadin:vaadin 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-core 24.7.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-core 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-core 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-core 25.2.0 - 25.2.6 &gt;=25.2.7<br /> com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 &gt;=23.6.14<br /> com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 &gt;=24.9.21<br /> com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 &gt;=24.10.10<br /> com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 &gt;=25.1.12<br /> com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 &gt;=25.2.7<br /> <br /> npm packages<br /> npm package Vulnerable versions Fixed version<br /> @vaadin/charts 23.0.0 - 23.6.4 &gt;=23.6.5<br /> @vaadin/charts 24.0.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/charts 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/charts 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/charts 25.2.0 - 25.2.8 &gt;=25.2.9<br /> @vaadin/component-base 24.7.0 - 24.9.17 &gt;=24.9.18<br /> @vaadin/component-base 24.10.0 - 24.10.4 &gt;=24.10.5<br /> @vaadin/component-base 25.0.0 - 25.1.11 &gt;=25.1.12<br /> @vaadin/component-base 25.2.0 - 25.2.8 &gt;=25.2.9