Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120350— Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed

Quick assessment

Affected
vaadin vaadin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vaadin 富文本编辑器在导出视频嵌入内容时未对其值进行转义，随后将生成的 HTML 解析为实时 DOM。攻击者可构造一个能突破 属性限制的值，从而在查看者的浏览器中执行恶意脚本。若攻击者能够编辑共享内容，即可粘贴包含该攻击载荷的视频嵌入；该载荷会被以 delta 格式存储，并在任何用户打开页面时（包括只读模式）执行脚本。 仅通过 方法持久化的内容受到影响。默认情况下，通过 和 设置和读取的 HTML 值会在服务器端经过白名单过滤，该白名单不包含 标签，因此视频嵌入无法通过此路径存活。Vaadin 24 及更早版

CVSS 5.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120350

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
Source: CVE Program / CVE List V5
Vulnerability Description
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode. Only content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor's own innerHTML, which the browser escapes. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4 Mitigation No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vaadin vaadin 25.0.0 ~ 25.0.13 -
vaadin vaadin-core 25.0.0 ~ 25.0.13 -
vaadin vaadin-rich-text-editor-flow 25.0.0 ~ 25.0.13 -
vaadin rich-text-editor 25.0.0 ~ 25.0.13 -

II. Public POCs for CVE-2026-120350

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120350

请登录查看更多情报信息。

Other References for CVE-2026-120350 (3)

IV. Related Vulnerabilities

Same product: vaadin
Same vendor: vaadin
Same weakness: CWE-79