CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

CVE-2026-107588

The Vaadin Charts library (specifically the bundled Highcharts library) is vulnerable to multiple issues including Prototype Pollution and Cross-Site Scripting (XSS) . The root cause is that Vaadin pins specific Highcharts versions (9.2.2 for Vaadin 22-24; 12.2.0 for Vaadin 25), preventing indepe...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@hilla/react-components (>=1.3.0-alpha3, <=1.6.4), @majinno/vaadin-components-import (>=1.0.1, <=1.0.16) +4 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=23.0.0, <=23.6.4)

@vaadin/charts NPM version =23.0.0, =1.3.0-alpha3, =1.0.1, =23.0.0, =23.0.14, =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=25.0.0, <=25.1.11), @vaadin/vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.0.0, <=25.1.11)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=24.10.0, <=24.10.4), @vaadin/vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.10.0, <=24.10.4)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=25.2.0, <=25.2.8), @vaadin/vaadin (>=25.2.0, <=25.3.0-alpha3) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.2.0, <=25.2.8)

@vaadin/charts NPM version =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

EUVD-2026-89951

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@hilla/react-components (>=2.0.0, <=2.4.0-alpha2), @hilla/react-crud (>=2.3.0-beta1, <=2.5.8) +6 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.0.0, <=24.9.17)

@vaadin/charts NPM version =24.0.0, =2.0.0, =2.3.0-beta1, =2.3.0-alpha1, =24.4.0-alpha10, =24.4.0-alpha12, =24.4.0-alpha10, =24.0.0-rc3, =24.10.0-alpha1 - hilla-admin-react 1.0.0 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base . The flaw occurs because the application fails to filter keys that address the prototype chain when merging user-controlled objects (e.g., parsed JSON) into chart configurations or a c...

PT-2026-103274

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

Prototype pollution in chart configuration and component i18n

The deep merge helpers in Vaadin Charts and in the i18n support of Vaadin components copy properties without filtering keys that address the prototype chain, so merging data the application does not control can add properties to Object.prototype and make them visible to every object in the runnin...

CVE-2026-91860: Improperly Controlled Modification of Object Prototype Attributes

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...