Vaadin Charts Fixes Highcharts XSS and Prototype Pollution in Versions 22 Through 25
Security teams must patch Vaadin 22 through 25 to address high-severity flaws in bundled Highcharts that allow cross-site scripting and object prototype manipulation.
Key points
- CVE-2026-107588 affects Vaadin 22 through 25 due to pinned, vulnerable Highcharts versions.
- The flaw enables cross-site scripting via credits, breadcrumbs, and exported chart attributes.
- Fixed releases are available for all affected major version branches starting today.
Vaadin has released updates for versions 22 through 25 to resolve high-severity vulnerabilities in its bundled Highcharts library. The National Vulnerability Database records this as CVE-2026-107588 with a CVSS score of 8.4.
What happened
Highsoft disclosed multiple flaws in the Highcharts library that Vaadin integrates into its Charts component. Vaadin versions 22 through 24 pin Highcharts version 9.2.2, while Vaadin 25 pins version 12.2.0. Because these versions are pinned, applications cannot mitigate the risks by independently upgrading the Highcharts library. The vulnerabilities include cross-site scripting issues reachable through credits.href, breadcrumbs.style, HTML text parsing during printing, and xlink:href attributes in exported charts.
Additionally, the library allows writes to Object.prototype through dotted series.keys paths. An application is affected if an attacker can control data that reaches the chart configuration. This exposure can occur through additionalOptions, via the updateConfiguration method, or through text options that accept markup. The fixed Vaadin versions apply Highsoft’s recommended workarounds to the bundled Highcharts at load time while keeping the original Highcharts version unchanged.
Why it matters
Environments running Vaadin 22.0.0 through 23.6.15 are exposed to these risks. Users of Vaadin 24.0.0 through 24.4.23, 24.5.0 through 24.7.15, 24.8.0 through 24.9.22, and 24.10.0 through 24.10.10 are also affected. In the Vaadin 25 branch, versions 25.0.0 through 25.2.9 and 25.3.0 contain the vulnerable code. Older Vaadin versions 10 through 13 and 15 through 22 are no longer supported and should be updated to supported branches.
The cross-site scripting flaws allow attackers to inject malicious scripts if they can influence chart configuration data. The prototype pollution weakness could lead to unexpected behavior or further exploitation within the application context. Since the library is bundled, the vulnerability persists regardless of external package management updates unless the specific Vaadin release is upgraded.
Our take on the response
- Upgrade Vaadin 22 to 23.6.16 or later to apply the necessary workarounds.
- Move Vaadin 24.0 through 24.4 to version 24.4.24 or newer.
- Update Vaadin 24.5 through 24.7 to version 24.7.16 or later.
- Patch Vaadin 24.8 through 24.9 to version 24.9.23 or newer.
- Upgrade Vaadin 24.10 to version 24.10.11 or later.
- Update Vaadin 25.0 through 25.2 to version 25.2.10 or newer.
- Move Vaadin 25.3 to version 25.3.1 or later.
What defenders should look for
Teams usually monitor for anomalous JavaScript execution in web application logs. Check whether user input is being reflected into chart configuration objects without proper sanitization. Look for unusual network requests to external domains from chart rendering endpoints. Verify that exported chart files do not contain unexpected script tags or malformed attributes. If prototype pollution occurs, watch for unexpected object properties appearing in application state. Contain potential abuse by restricting input validation on chart data sources.
Background: Input validation
Input validation is the process of verifying that data entering a system matches expected formats, types, and ranges before processing. It prevents malicious payloads from executing code or crashing services. You must validate at every entry point, not just the user interface, because attackers bypass front-end checks entirely.
Read the full guide: What Is Input Validation: How to Stop Bad Data From Breaking Systems
What to do and how to stay safe: Vaadin
- Audit applications using Vaadin Charts to identify if user-controlled data reaches chart configuration methods.
- Verify current Vaadin versions against the vulnerable ranges listed in the NVD record.
- Apply the specific fixed versions provided for each Vaadin major release branch.
- Monitor web server logs for signs of cross-site scripting attempts targeting chart endpoints.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Vaadin versions are affected by CVE-2026-107588?
Vaadin 22.0.0 through 23.6.15, 24.0.0 through 24.10.10, and 25.0.0 through 25.3.0 are affected.
Can I fix this by updating only the Highcharts library?
No, because Vaadin pins specific Highcharts versions, so you must upgrade the Vaadin framework itself.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-107588 as HIGH with a CVSS score of 8.4.
