CVE-2026-91860 - Vulnerability Details

- Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

Description

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 23.0.0 - 23.6.13
Vaadin 24.0.0 - 24.9.20
Vaadin 24.10.0 - 24.10.9
Vaadin 25.0.0 - 25.1.11
Vaadin 25.2.0 - 25.2.6

Mitigation
Upgrade to 23.6.14
Upgrade to 24.9.21
Upgrade to 24.10.10
Upgrade to 25.1.12
Upgrade to 25.2.7 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts
Maven coordinates Vulnerable versions Fixed version
com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7

npm packages
npm package Vulnerable versions Fixed version
@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5
@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18
@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5
@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12
@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9
@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18
@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5
@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12
@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9

Published: 2026-09-30

Score: 6.3 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vaadin

unaffected

Version	Status	Constraints
`23.0.0`	affected	< 23.6.14
`24.0.0`	affected	< 24.9.21
`24.10.0`	affected	< 24.10.10
`25.0.0`	affected	< 25.1.12
`25.2.0`	affected	< 25.2.7

vaadin

vaadin-core

unaffected

Version	Status	Constraints
`24.7.0`	affected	< 24.9.21
`24.10.0`	affected	< 24.10.10
`25.0.0`	affected	< 25.1.12
`25.2.0`	affected	< 25.2.7

vaadin

vaadin-charts-flow

unaffected

Version	Status	Constraints
`23.0.0`	affected	< 23.6.14
`24.0.0`	affected	< 24.9.21
`24.10.0`	affected	< 24.10.10
`25.0.0`	affected	< 25.1.12
`25.2.0`	affected	< 25.2.7

vaadin

@vaadin/charts

unaffected

Version	Status	Constraints
`23.0.0`	affected	< 23.6.5
`24.0.0`	affected	< 24.9.18
`24.10.0`	affected	< 24.10.5
`25.0.0`	affected	< 25.1.12
`25.2.0`	affected	< 25.2.9

vaadin

@vaadin/component-base

unaffected

Version	Status	Constraints
`24.7.0`	affected	< 24.9.18
`24.10.0`	affected	< 24.10.5
`25.0.0`	affected	< 25.1.12
`25.2.0`	affected	< 25.2.9

No data.

No data available yet.

Remediation

Vendor Solution

Users of affected versions should apply the following mitigation or upgrade.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/vaadin/web-components/pull/12483
https://github.com/vaadin/web-components/pull/12492
https://github.com/vaadin/web-components/pull/12493
https://github.com/vaadin/web-components/pull/12494
https://github.com/vaadin/web-components/pull/12496
https://github.com/vaadin/web-components/pull/12559
https://vaadin.com/security/cve-2026-91860

History

Wed, 30 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7 npm packages npm package Vulnerable versions Fixed version @vaadin/charts 23.0.0 - 23.6.4 >=23.6.5 @vaadin/charts 24.0.0 - 24.9.17 >=24.9.18 @vaadin/charts 24.10.0 - 24.10.4 >=24.10.5 @vaadin/charts 25.0.0 - 25.1.11 >=25.1.12 @vaadin/charts 25.2.0 - 25.2.8 >=25.2.9 @vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18 @vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5 @vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12 @vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
Title		Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Weaknesses		CWE-1321
References		https://github.com/vaadin/web-components/pull/12483 https://github.com/vaadin/web-components/pull/12492 https://github.com/vaadin/web-components/pull/12493 https://github.com/vaadin/web-components/pull/12494 https://github.com/vaadin/web-components/pull/12496 https://github.com/vaadin/web-components/pull/12559 https://vaadin.com/security/cve-2026-91860
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: Vaadin

Published: 2026-09-30T13:13:05.996Z

Updated: 2026-09-30T14:26:23.618Z

Reserved: 2026-09-15T09:33:38.900Z

Link: CVE-2026-91860

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-30T14:17:34.133

Modified: 2026-09-30T14:17:34.133

Link: CVE-2026-91860

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-1321

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object