CVE-2026-107588

Name of the Vulnerable Software and Affected Versions Vaadin versions 22.0.0 through 23.6.15 Vaadin versions 24.0.0 through 24.4.23 Vaadin versions 24.5.0 through 24.7.15 Vaadin versions 24.8.0 through 24.9.22 Vaadin versions 24.10.0 through 24.10.10 Vaadin versions 25.0.0 through 25.2.9 Vaadin version 25.3.0

Description Vaadin Charts uses the Highcharts library, which contains several issues reachable through the chart configuration. These include cross-site scripting (XSS) via credits.href, breadcrumbs.style, HTML text parsing during printing, and xlink:href attributes in exported charts. Additionally, it allows writes to Object.prototype through dotted series.keys paths. An application is affected when attacker-controlled data reaches the chart configuration, such as through additionalOptions, the updateConfiguration() function, or text options that accept markup.

Recommendations Upgrade Vaadin versions 22.0.0 through 23.6.15 to 23.6.16 Upgrade Vaadin versions 24.0.0 through 24.4.23 to 24.4.24 Upgrade Vaadin versions 24.5.0 through 24.7.15 to 24.7.16 Upgrade Vaadin versions 24.8.0 through 24.9.22 to 24.9.23 Upgrade Vaadin versions 24.10.0 through 24.10.10 to 24.10.11 Upgrade Vaadin versions 25.0.0 through 25.2.9 to 25.2.10 Upgrade Vaadin version 25.3.0 to 25.3.1 or newer