Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-107588

Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

Affects Vaadin Charts releases bundling Highcharts 9.2.2 (Vaadin 22 to 24) or 12.2.0 (Vaadin 25), with fixed releases on each branch such as 23.6.16. No vendor rating is given.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Fix
Fixed in 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, and 9 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  4. Record last updated

Affected versions

  • com.vaadin:vaadin

    From 22.0.0 · fixed in 23.6.16; From 24.0.0 · fixed in 24.4.24; From 24.5.0 · fixed in 24.7.16; From 24.8.0 · fixed in 24.9.23; From 24.10.0 · fixed in 24.10.11; From 25.0.0 · through 25.0.13; From 25.1.0 · through 25.1.13; From 25.2.0 · fixed in 25.2.10; From 25.3.0 · fixed in 25.3.1

  • com.vaadin:vaadin-charts-flow

    From 22.0.0 · fixed in 23.6.16; From 24.0.0 · fixed in 24.4.24; From 24.5.0 · fixed in 24.7.15; From 24.8.0 · fixed in 24.9.23; From 24.10.0 · fixed in 24.10.11; From 25.0.0 · through 25.0.13; From 25.1.0 · through 25.1.13; From 25.2.0 · fixed in 25.2.10; From 25.3.0 · fixed in 25.3.1

  • com.vaadin:vaadin-charts-flow-svg-generator

    From 21.0.0 · fixed in 23.6.16; From 24.0.0 · fixed in 24.4.24; From 24.5.0 · fixed in 24.7.15; From 24.8.0 · fixed in 24.9.23; From 24.10.0 · fixed in 24.10.11; From 25.0.0 · through 25.0.13; From 25.1.0 · through 25.1.13; From 25.2.0 · fixed in 25.2.10; From 25.3.0 · fixed in 25.3.1

  • @vaadin/charts

    From 22.0.0 · fixed in 23.6.7; From 24.0.0 · fixed in 24.4.19; From 24.5.0 · fixed in 24.7.13; From 24.8.0 · fixed in 24.9.19; From 24.10.0 · fixed in 24.10.7; From 25.0.0 · through 25.0.13; From 25.1.0 · through 25.1.14; From 25.2.0 · fixed in 25.2.14; From 25.3.0 · fixed in 25.3.1

References 25

vaadin.com

GitHub · highcharts/highcharts

GitHub · vaadin/web-components

GitHub · vaadin/flow-components

FAQ

Questions about CVE-2026-107588

What does this mean?

The bundled Highcharts library has several flaws that let data reaching the chart configuration write properties onto Object.prototype and run script in the user's browser. One credits href issue is reachable through Credits.setUnsafeHref() or where the allowed scheme list is widened, but not through the default Credits.setHref() path.Source: vaadin.com

Am I affected, and how do I check?

Vaadin Charts on Vaadin 22 through 25 is in the affected ranges, with the bundled Highcharts pinned to 9.2.2 on Vaadin 22 to 24 and 12.2.0 on Vaadin 25. Check the Vaadin version in the project's build file and the @vaadin/charts version in package.json. Charts whose configuration the application builds itself are listed as not affected.Source: vaadin.com

What should I do about it?

Upgrade to 23.6.16 or the fixed release on the same branch, as listed in the fixed-version ranges for each Vaadin line. The advisory gives no workaround.Source: vaadin.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data