Medium

Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

Type: advisorySource: Official CVE List1 source record

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=

Announced 30 Sept 2026Source revision 1

Original source ↗

CVE-2026-91860

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-91860

vaadin

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

vaadin-core

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

vaadin-charts-flow

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

@vaadin/charts

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

@vaadin/component-base

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/vaadin/platform",
    "vendor": "vaadin",
    "product": "vaadin",
    "versions": [
      {
        "status": "affected",
        "version": "23.0.0",
        "lessThan": "23.6.14",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "24.0.0",
        "lessThan": "24.9.21",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "24.10.0",
        "lessThan": "24.10.10",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "25.1.12",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.2.0",
        "lessThan": "25.2.7",
        "versionType": "maven"
      }
    ],
    "packageName": "com.vaadin:vaadin",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://github.com/vaadin/platform",
    "vendor": "vaadin",
    "product": "vaadin-core",
    "versions": [
      {
        "status": "affected",
        "version": "24.7.0",
        "lessThan": "24.9.21",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "24.10.0",
        "lessThan": "24.10.10",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "25.1.12",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.2.0",
        "lessThan": "25.2.7",
        "versionType": "maven"
      }
    ],
    "packageName": "com.vaadin:vaadin-core",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://github.com/vaadin/flow-components",
    "vendor": "vaadin",
    "product": "vaadin-charts-flow",
    "versions": [
      {
        "status": "affected",
        "version": "23.0.0",
        "lessThan": "23.6.14",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "24.0.0",
        "lessThan": "24.9.21",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "24.10.0",
        "lessThan": "24.10.10",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "25.1.12",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "25.2.0",
        "lessThan": "25.2.7",
        "versionType": "maven"
      }
    ],
    "packageName": "com.vaadin:vaadin-charts-flow",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://github.com/vaadin/web-components",
    "vendor": "vaadin",
    "product": "@vaadin/charts",
    "versions": [
      {
        "status": "affected",
        "version": "23.0.0",
        "lessThan": "23.6.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "24.0.0",
        "lessThan": "24.9.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "24.10.0",
        "lessThan": "24.10.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "25.1.12",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.2.0",
        "lessThan": "25.2.9",
        "versionType": "semver"
      }
    ],
    "packageName": "@vaadin/charts",
    "collectionURL": "https://registry.npmjs.org",
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://github.com/vaadin/web-components",
    "vendor": "vaadin",
    "product": "@vaadin/component-base",
    "versions": [
      {
        "status": "affected",
        "version": "24.7.0",
        "lessThan": "24.9.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "24.10.0",
        "lessThan": "24.10.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.0.0",
        "lessThan": "25.1.12",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.2.0",
        "lessThan": "25.2.9",
        "versionType": "semver"
      }
    ],
    "packageName": "@vaadin/component-base",
    "collectionURL": "https://registry.npmjs.org",
    "defaultStatus": "unaffected"
  }
]

Related CVEs: CVE-2026-91860
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4410 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:51:17 GMT
Publisher date: Wed, 30 Sep 2026 13:13:05 GMT

Read the original announcement