{"id":31295,"date":"2026-10-01T00:32:00","date_gmt":"2026-09-30T16:32:00","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-91860"},"modified":"2026-10-01T00:32:00","modified_gmt":"2026-09-30T16:32:00","slug":"cve-2026-91860","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-91860","title":{"rendered":"CVE-2026-91860 – A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and"},"content":{"rendered":"

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component’s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.<\/p>\n

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<\/p>\n

Product version
\nVaadin 23.0.0 – 23.6.13
\nVaadin 24.0.0 – 24.9.20
\nVaadin 24.10.0 – 24.10.9
\nVaadin 25.0.0 – 25.1.11
\nVaadin 25.2.0 – 25.2.6<\/p>\n

Mitigation
\nUpgrade to 23.6.14
\nUpgrade to 24.9.21
\nUpgrade to 24.10.10
\nUpgrade to 25.1.12
\nUpgrade to 25.2.7 or newer<\/p>\n

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<\/p>\n

Artifacts
\nMaven coordinates Vulnerable versions Fixed version
\ncom.vaadin:vaadin 23.0.0 – 23.6.13 >=23.6.14
\ncom.vaadin:vaadin 24.0.0 – 24.9.20 >=24.9.21
\ncom.vaadin:vaadin 24.10.0 – 24.10.9 >=24.10.10
\ncom.vaadin:vaadin 25.0.0 – 25.1.11 >=25.1.12
\ncom.vaadin:vaadin 25.2.0 – 25.2.6 >=25.2.7
\ncom.vaadin:vaadin-core 24.7.0 – 24.9.20 >=24.9.21
\ncom.vaadin:vaadin-core 24.10.0 – 24.10.9 >=24.10.10
\ncom.vaadin:vaadin-core 25.0.0 – 25.1.11 >=25.1.12
\ncom.vaadin:vaadin-core 25.2.0 – 25.2.6 >=25.2.7
\ncom.vaadin:vaadin-charts-flow 23.0.0 – 23.6.13 >=23.6.14
\ncom.vaadin:vaadin-charts-flow 24.0.0 – 24.9.20 >=24.9.21
\ncom.vaadin:vaadin-charts-flow 24.10.0 – 24.10.9 >=24.10.10
\ncom.vaadin:vaadin-charts-flow 25.0.0 – 25.1.11 >=25.1.12
\ncom.vaadin:vaadin-charts-flow 25.2.0 – 25.2.6 >=25.2.7<\/p>\n

npm packages
\nnpm package Vulnerable versions Fixed version
\n@vaadin\/charts 23.0.0 – 23.6.4 >=23.6.5
\n@vaadin\/charts 24.0.0 – 24.9.17 >=24.9.18
\n@vaadin\/charts 24.10.0 – 24.10.4 >=24.10.5
\n@vaadin\/charts 25.0.0 – 25.1.11 >=25.1.12
\n@vaadin\/charts 25.2.0 – 25.2.8 >=25.2.9
\n@vaadin\/component-base 24.7.0 – 24.9.17 >=24.9.18
\n@vaadin\/component-base 24.10.0 – 24.10.4 >=24.10.5
\n@vaadin\/component-base 25.0.0 – 25.1.11 >=25.1.12
\n@vaadin\/component-base 25.2.0 – 25.2.8 >=25.2.9<\/p>\n","protected":false},"excerpt":{"rendered":"

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-31295","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/31295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=31295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=31295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=31295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}