Multiple vulnerabilities in the Highcharts library bundled with Vaadin Charts

🗓️ 21 Oct 2026 00:00:00Reported by VaadinType

Prototype pollution and XSS in Vaadin Charts via Highcharts library configuration.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-107588	21 Oct 202619:58	–	circl
CVE	CVE-2026-107588	21 Oct 202618:22	–	cve
Cvelist	CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts	21 Oct 202618:22	–	cvelist
EUVD	EUVD-2026-107491	21 Oct 202618:22	–	euvd
Mend	CVE-2026-107588	21 Oct 202618:22	–	mend
NVD	CVE-2026-107588	21 Oct 202619:16	–	nvd
Positive Technologies	PT-2026-120763	21 Oct 202600:00	–	ptsecurity

Vulners

Node

vaadin vaadinRange22.0.0–23.6.16

vaadin vaadinRange24.0.0–24.4.24

vaadin vaadinRange24.5.0–24.7.16

vaadin vaadinRange24.8.0–24.9.23

vaadin vaadinRange24.10.0–24.10.11

vaadin vaadinRange25.0.0–25.2.10

com.vaadin vaadinRange22.0.0–23.6.16

com.vaadin vaadinRange24.0.0–24.4.24

com.vaadin vaadinRange24.5.0–24.7.16

com.vaadin vaadinRange24.8.0–24.9.23

com.vaadin vaadinRange24.10.0–24.10.11

com.vaadin vaadinRange25.0.0–25.2.10

vaadin @vaadin/chartsRange22.0.0–23.6.7

vaadin @vaadin/chartsRange24.0.0–24.4.19

vaadin @vaadin/chartsRange24.5.0–24.7.13

vaadin @vaadin/chartsRange24.8.0–24.9.19

vaadin @vaadin/chartsRange24.10.0–24.10.7

vaadin @vaadin/chartsRange25.0.0–25.2.14

Source	Link
github	www.github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c
github	www.github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7
github	www.github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789
github	www.github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
github	www.github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
github	www.github.com/vaadin/web-components/pull/12886
github	www.github.com/vaadin/flow-components/pull/10283

21 Oct 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.4

EPSS0.00524