CVE-2026-91860Published
Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
cve-program · CVE-2026-91860
Publishedcom.vaadin:vaadin
https://repo.maven.apache.org/maven2
Original vendor version evidence · not evaluated as a NuGet range
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin",
"product": "vaadin",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
}com.vaadin:vaadin-core
https://repo.maven.apache.org/maven2
Original vendor version evidence · not evaluated as a NuGet range
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-core",
"product": "vaadin-core",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.7.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
}com.vaadin:vaadin-charts-flow
https://repo.maven.apache.org/maven2
Original vendor version evidence · not evaluated as a NuGet range
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-charts-flow",
"product": "vaadin-charts-flow",
"repo": "https://github.com/vaadin/flow-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
}@vaadin/charts
https://registry.npmjs.org
Original vendor version evidence · not evaluated as a NuGet range
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/charts",
"product": "@vaadin/charts",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.5",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
}@vaadin/component-base
https://registry.npmjs.org
Original vendor version evidence · not evaluated as a NuGet range
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/component-base",
"product": "@vaadin/component-base",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.7.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON