CVE-2026-91860— Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Quick assessment
Affected
vaadin vaadin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vaadin Charts 和 Vaadin Component Base 中的深度合并（deep merge）辅助函数存在原型污染漏洞。如果将应用程序未完全控制的对象合并到图表配置或组件的 i18n 属性中，会向 写入数据，导致被注入的属性在运行中的应用中的所有对象中可见。 受影响版本的用户应采取以下缓解措施或进行升级。已修复此问题的发布版本包括： 产品版本： Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaad
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Source: CVE Program / CVE List V5
Vulnerability Description
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 23.0.0 - 23.6.13
Vaadin 24.0.0 - 24.9.20
Vaadin 24.10.0 - 24.10.9
Vaadin 25.0.0 - 25.1.11
Vaadin 25.2.0 - 25.2.6
Mitigation
Upgrade to 23.6.14
Upgrade to 24.9.21
Upgrade to 24.10.10
Upgrade to 25.1.12
Upgrade to 25.2.7 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts
Maven coordinates Vulnerable versions Fixed version
com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7
npm packages
npm package Vulnerable versions Fixed version
@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5
@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18
@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5
@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12
@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9
@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18
@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5
@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12
@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| vaadin | vaadin | 23.0.0 ~ 23.6.14 | - |
|
| vaadin | vaadin-core | 24.7.0 ~ 24.9.21 | - |
|
| vaadin | vaadin-charts-flow | 23.0.0 ~ 23.6.14 | - |
|
| vaadin | @vaadin/charts | 23.0.0 ~ 23.6.5 | - |
|
| vaadin | @vaadin/component-base | 24.7.0 ~ 24.9.18 | - |
|
II. Public POCs for CVE-2026-91860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91860
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-91860 (6)
Vendor Advisories for CVE-2026-91860 (1)
IV. Related Vulnerabilities
Same product: vaadin
-
CVE-2026-93547
Missing Authorization Check in Vaadin Spreadsheet Allows Cel -
CVE-2026-2742
Unauthorized session creation via reserved framework path ac -
CVE-2026-2741
Zip Slip Path Traversal on Node Unpack -
CVE-2025-15022
Cross-site scripting in Action caption -
CVE-2025-9467
Possibility to bypass file upload validation on the server-s
Same vendor: vaadin
-
CVE-2026-93547
Missing Authorization Check in Vaadin Spreadsheet Allows Cel -
CVE-2026-7860
Possible information disclosure of environment variables in -
CVE-2026-2742
Unauthorized session creation via reserved framework path ac -
CVE-2026-2741
Zip Slip Path Traversal on Node Unpack -
CVE-2025-15022
Cross-site scripting in Action caption
Same weakness: CWE-1321
-
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Option -
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter -
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Al -
CVE-2026-97724
React Native Worklets<0.12.2原型污染致DoS -
CVE-2026-97151
mammoth<1.12.2原型链污染漏洞
V. Comments for CVE-2026-91860
No comments yet