Medium
Security advisory
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-25028
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:05 UTC · Revision 1
Source evidence
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector
osv:CVE-2019-25028
Complete source record
{
"id": "b943c3471c5c173329c97b0884a9b231462a1c36b988712c66e7bfd35a5b8b02",
"url": "https://osv.dev/vulnerability/CVE-2019-25028",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-25028",
"summary": "Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector",
"evidence": "osv:CVE-2019-25028",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-25028",
"aliases": [
"CVE-2019-25028",
"GHSA-q74r-4xw3-ppx9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vaadin/framework",
"type": "GIT",
"events": [
{
"introduced": "fb74e3d03793a7f9c433a7be583d55e3e2d1c35d"
},
{
"fixed": "c39400b55da214b2b6eb87260fb8f485a78a8aa1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.5"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25028.json",
"vanir_signatures": [
{
"id": "CVE-2019-25028-3ad2e415",
"digest": {
"length": 325,
"function_hash": "224089112780054838281096973252255515795"
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/window/WindowTwinColSelectTest.java",
"function": "testBothVisibleInitially"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-25028-95f41e84",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323027927719322879694646477660480758366",
"140843719381022169385478702298695908139",
"223121810745035292844364844150107232529",
"241783893905197447019632742179906486824",
"118877264746139548812131047659602460117",
"212798713455239224283024788850551583708",
"268359675270704258968730407281331665124",
"43624132584534113624707093921107228950",
"142659331150020933318034414284366553825",
"262969033099155336909030685456245982774",
"296315255155010085321854487652361016702",
"293809256608442915435225365561121041433",
"43624132584534113624707093921107228950",
"142659331150020933318034414284366553825",
"262969033099155336909030685456245982774",
"232005886596506853569304581689489718279"
]
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/window/WindowTwinColSelectTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25028-a2f91c9d",
"digest": {
"length": 1410,
"function_hash": "336641603681000015035378260319375439394"
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/grid/GridResizeHiddenColumnTest.java",
"function": "testDragResizeHiddenColumnSize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-25028-bc4e3af8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"145802151508175598029430370079265957318",
"297195917877074439204303470271283275343",
"263492562077096081474736922498611609",
"68961282755823214253510235711551723968",
"262127668737227261877694020220696387728",
"230523905564265709666962162540234440708",
"47900019607868529310579129746089630123",
"311624149587918573141227453126641427703",
"271179997655227917557505329999567111820",
"217596032764845595737875797920695929474",
"103388785315313009794110552235790421903"
]
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/grid/GridResizeHiddenColumnTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25028-c31af355",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133205553974526904938020591278604924244",
"140086636728589380866893370144692075481",
"72308381027048159490602102591725513370",
"77708941278154773478948984726792384600",
"34034289072158396475208353483333544981",
"157769354181333844384100947133441727370",
"185710998852128006652124351544874218493",
"26585018608724908099507441366239354922",
"169385461260460829198110331323426997539"
]
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/combobox/ComboBoxClosePopupRetainTextTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-25028-e7f36790",
"digest": {
"length": 565,
"function_hash": "289025086072825599291112012723523489650"
},
"source": "https://github.com/vaadin/framework/commit/c39400b55da214b2b6eb87260fb8f485a78a8aa1",
"target": {
"file": "uitest/src/test/java/com/vaadin/tests/components/window/WindowTwinColSelectTest.java",
"function": "testBothVisibleAfterResize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:06:53Z"
}
}
],
"modified": "2026-10-24T14:06:53.111137842Z",
"provider": "osv",
"references": [
"https://vaadin.com/security/cve-2019-25028",
"https://github.com/vaadin/framework/pull/11644",
"https://github.com/vaadin/framework/pull/11645"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*"
],
"vendor_product": "vaadin:vaadin",
"extracted_events": [
{
"range": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.7.20"
},
{
"introduced": "7.4.0"
},
{
"fixed": "7.7.20"
},
{
"introduced": "7.4.0"
},
{
"fixed": "7.7.20"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.5"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.5"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-25028",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443059,
"published_at": "2021-04-23T16:15:08.267+00:00"
}