CVE-2026-91860

Estado: Pendiente de análisisMedia (6.3)—

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6

Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer

Leer descripción completaMostrar menos

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7

npm packages npm package Vulnerable versions Fixed version @vaadin/charts 23.0.0 - 23.6.4 >=23.6.5 @vaadin/charts 24.0.0 - 24.9.17 >=24.9.18 @vaadin/charts 24.10.0 - 24.10.4 >=24.10.5 @vaadin/charts 25.0.0 - 25.1.11 >=25.1.12 @vaadin/charts 25.2.0 - 25.2.8 >=25.2.9 @vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18 @vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5 @vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12 @vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 6.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.47%
Percentil entre todas las CVEs puntuadas: 38
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact80 %

Prototype pollution en funciones merge de Vaadin (AV:N/AC:L) permite inyectar propiedades en Object.prototype, contaminando objetos globales y ejecutando lógica maliciosa en la aplicación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Encrypt Sensitive Information

Tecnologías afectadas (5)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vaadin — Charts^AI Vaadin — Component Base^AI Vaadin — Vaadin^AI Vaadin — Vaadin Charts Flow^AI Vaadin — Vaadin Core^AI

CWE

CWE-1321

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-91860",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-91860",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-30T14:26:16.234947Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@vaadin.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@vaadin.com",
      "affectedData": [
        {
          "repo": "https://github.com/vaadin/platform",
          "vendor": "vaadin",
          "product": "vaadin",
          "versions": [
            {
              "status": "affected",
              "version": "23.0.0",
              "lessThan": "23.6.14",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "lessThan": "24.9.21",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.10",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.7",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/platform",
          "vendor": "vaadin",
          "product": "vaadin-core",
          "versions": [
            {
              "status": "affected",
              "version": "24.7.0",
              "lessThan": "24.9.21",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.10",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.7",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin-core",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/flow-components",
          "vendor": "vaadin",
          "product": "vaadin-charts-flow",
          "versions": [
            {
              "status": "affected",
              "version": "23.0.0",
              "lessThan": "23.6.14",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "lessThan": "24.9.21",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.10",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.7",
              "versionType": "maven"
            }
          ],
          "packageName": "com.vaadin:vaadin-charts-flow",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/web-components",
          "vendor": "vaadin",
          "product": "@vaadin/charts",
          "versions": [
            {
              "status": "affected",
              "version": "23.0.0",
              "lessThan": "23.6.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "24.0.0",
              "lessThan": "24.9.18",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.9",
              "versionType": "semver"
            }
          ],
          "packageName": "@vaadin/charts",
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/vaadin/web-components",
          "vendor": "vaadin",
          "product": "@vaadin/component-base",
          "versions": [
            {
              "status": "affected",
              "version": "24.7.0",
              "lessThan": "24.9.18",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "24.10.0",
              "lessThan": "24.10.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "25.0.0",
              "lessThan": "25.1.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "25.2.0",
              "lessThan": "25.2.9",
              "versionType": "semver"
            }
          ],
          "packageName": "@vaadin/component-base",
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-30T14:17:34.133",
  "references": [
    {
      "url": "https://github.com/vaadin/web-components/pull/12483",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/web-components/pull/12492",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/web-components/pull/12493",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/web-components/pull/12494",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/web-components/pull/12496",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/web-components/pull/12559",
      "source": "security@vaadin.com"
    },
    {
      "url": "https://vaadin.com/security/cve-2026-91860",
      "source": "security@vaadin.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vaadin.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.0.0 - 23.6.13\nVaadin 24.0.0 - 24.9.20\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.21\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7\n\nnpm packages\nnpm package Vulnerable versions Fixed version\n@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5\n@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18\n@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5\n@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12\n@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9\n@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18\n@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5\n@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12\n@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9"
    }
  ],
  "lastModified": "2026-09-30T16:38:20.847",
  "sourceIdentifier": "security@vaadin.com"
}