Multiple vulnerabilities in the Highcharts library bundled with Vaadin Charts
Severity:
High (Base score 8.4) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
CVE entry:
Overview
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, so an application cannot remove the vulnerabilities Highsoft disclosed on 29 September 2026 by upgrading Highcharts on its own. Where data an attacker controls reaches the chart configuration, those vulnerabilities allow writing properties onto Object.prototype and running script in the user's browser.
See CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Description
Vaadin Charts bundles Highcharts 9.2.2 on Vaadin 22 to 24 and Highcharts 12.2.0 on Vaadin 25, pinned to an exact version. Highsoft published six advisories for Highcharts on 29 September 2026, five of which reach the versions Vaadin pins.
| Issue | Upstream advisory | Vaadin 22 to 24 | Vaadin 25 |
|---|---|---|---|
| Dotted `series.keys` paths write to Object.prototype | GHSA-rmqc-xvr3-v46c | affected | affected |
| A `javascript:` URL in `credits.href` runs script when clicked | GHSA-5793-x2q3-c3q7 | affected | affected |
| `breadcrumbs.style` keys become SVG event handler attributes | GHSA-35rr-xwfh-x789 | not affected | affected |
| HTML text parsing falls back to unfiltered innerHTML while printing | GHSA-65hg-cf3f-5m39 | not affected | affected |
| A `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts | GHSA-mw4f-gj5x-6xr4 | not affected | affected |
All of them require that data the application does not control reaches the chart configuration. Charts whose configuration the application builds itself are not affected.
Through the web components API the issues are reachable where an application assigns an object it did not construct itself, typically one parsed from JSON, to the additionalOptions property of <vaadin-chart> or <vaadin-chart-series>, to updateConfiguration(), or directly to the configuration property.
Through the Java (Flow) API the typed configuration model limits which property names reach the client, but it passes string values through unchanged. The dotted keys issue is reachable through setKeys() and addKey() on the PlotOptions classes. The credits issue is not reachable through Credits.setHref() with the default configuration, which rejects schemes outside URL_SAFE_SCHEMES, but it is reachable through Credits.setUnsafeHref() and where an application widens that scheme list. The text parsing and xlink:href issues are reachable through the options that accept markup, such as Title.setText(), Subtitle.setText(), axis labels, data labels and tooltip formats. The breadcrumbs issue is not reachable through the Java model, because Breadcrumbs.setStyle() takes a typed Style.
Server-side SVG export is affected as well. SVGGenerator in vaadin-charts-flow-svg-generator renders a chart configuration with its own copy of Highcharts in a Node.js process, so the xlink:href issue applies to the SVG it returns and the dotted keys issue to the process that renders it. A new process starts for each generate() call, so injected properties do not persist between exports.
The fixed versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, in the browser and in the SVG generator alike. The bundled Highcharts version does not change, so a dependency scanner still reports highcharts 9.2.2 or 12.2.0 on a fixed Vaadin version.
Note that chart options holding a function value, set through setFormatter() and similar methods in Java or as _fn_ properties in JSON, are evaluated as JavaScript by design. Applications must never pass untrusted data to those APIs, and this advisory does not change that.
Through the web components API the issues are reachable where an application assigns an object it did not construct itself, typically one parsed from JSON, to the additionalOptions property of <vaadin-chart> or <vaadin-chart-series>, to updateConfiguration(), or directly to the configuration property.
Through the Java (Flow) API the typed configuration model limits which property names reach the client, but it passes string values through unchanged. The dotted keys issue is reachable through setKeys() and addKey() on the PlotOptions classes. The credits issue is not reachable through Credits.setHref() with the default configuration, which rejects schemes outside URL_SAFE_SCHEMES, but it is reachable through Credits.setUnsafeHref() and where an application widens that scheme list. The text parsing and xlink:href issues are reachable through the options that accept markup, such as Title.setText(), Subtitle.setText(), axis labels, data labels and tooltip formats. The breadcrumbs issue is not reachable through the Java model, because Breadcrumbs.setStyle() takes a typed Style.
Server-side SVG export is affected as well. SVGGenerator in vaadin-charts-flow-svg-generator renders a chart configuration with its own copy of Highcharts in a Node.js process, so the xlink:href issue applies to the SVG it returns and the dotted keys issue to the process that renders it. A new process starts for each generate() call, so injected properties do not persist between exports.
The fixed versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, in the browser and in the SVG generator alike. The bundled Highcharts version does not change, so a dependency scanner still reports highcharts 9.2.2 or 12.2.0 on a fixed Vaadin version.
Note that chart options holding a function value, set through setFormatter() and similar methods in Java or as _fn_ properties in JSON, are evaluated as JavaScript by design. Applications must never pass untrusted data to those APIs, and this advisory does not change that.
Affected products and mitigation
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
| Product version | Mitigation |
|---|---|
| Vaadin 22.0.0 - 23.6.15 | Upgrade to 23.6.16 |
| Vaadin 24.0.0 - 24.4.23 | Upgrade to 24.4.24 |
| Vaadin 24.5.0 - 24.7.15 | Upgrade to 24.7.16 |
| Vaadin 24.8.0 - 24.9.22 | Upgrade to 24.9.23 |
| Vaadin 24.10.0 - 24.10.10 | Upgrade to 24.10.11 |
| Vaadin 25.0.0 - 25.2.9 | Upgrade to 25.2.10 |
| Vaadin 25.3.0 | Upgrade to 25.3.1 or newer |
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Do not pass data the application does not control to the chart configuration. That covers the additionalOptions property of <vaadin-chart> and <vaadin-chart-series>, updateConfiguration() and the configuration property, setKeys() and addKey() on the PlotOptions classes, Credits.setUnsafeHref(), and the text options that accept markup.
Do not pass data the application does not control to the chart configuration. That covers the additionalOptions property of <vaadin-chart> and <vaadin-chart-series>, updateConfiguration() and the configuration property, setKeys() and addKey() on the PlotOptions classes, Credits.setUnsafeHref(), and the text options that accept markup.
Artifacts
| Maven coordinates | Vulnerable version | Fixed version |
|---|---|---|
| com.vaadin:vaadin | 22.0.0 - 23.6.15 | ≥23.6.16 |
| com.vaadin:vaadin | 24.0.0 - 24.4.23 | ≥24.4.24 |
| com.vaadin:vaadin | 24.5.0 - 24.7.15 | ≥24.7.16 |
| com.vaadin:vaadin | 24.8.0 - 24.9.22 | ≥24.9.23 |
| com.vaadin:vaadin | 24.10.0 - 24.10.10 | ≥24.10.11 |
| com.vaadin:vaadin | 25.0.0 - 25.0.13 | ≥25.2.10 |
| com.vaadin:vaadin | 25.1.0 - 25.1.13 | ≥25.2.10 |
| com.vaadin:vaadin | 25.2.0 - 25.2.9 | ≥25.2.10 |
| com.vaadin:vaadin | 25.3.0 | ≥25.3.1 |
| com.vaadin:vaadin-charts-flow | 22.0.0 - 23.6.15 | ≥23.6.16 |
| com.vaadin:vaadin-charts-flow | 24.0.0 - 24.4.22 | ≥24.4.24 |
| com.vaadin:vaadin-charts-flow | 24.5.0 - 24.7.14 | ≥24.7.15 |
| com.vaadin:vaadin-charts-flow | 24.8.0 - 24.9.22 | ≥24.9.23 |
| com.vaadin:vaadin-charts-flow | 24.10.0 - 24.10.10 | ≥24.10.11 |
| com.vaadin:vaadin-charts-flow | 25.0.0 - 25.0.13 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow | 25.1.0 - 25.1.13 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow | 25.2.0 - 25.2.9 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow | 25.3.0 | ≥25.3.1 |
| com.vaadin:vaadin-charts-flow-svg-generator | 21.0.0 - 23.6.15 | ≥23.6.16 |
| com.vaadin:vaadin-charts-flow-svg-generator | 24.0.0 - 24.4.22 | ≥24.4.24 |
| com.vaadin:vaadin-charts-flow-svg-generator | 24.5.0 - 24.7.14 | ≥24.7.15 |
| com.vaadin:vaadin-charts-flow-svg-generator | 24.8.0 - 24.9.22 | ≥24.9.23 |
| com.vaadin:vaadin-charts-flow-svg-generator | 24.10.0 - 24.10.10 | ≥24.10.11 |
| com.vaadin:vaadin-charts-flow-svg-generator | 25.0.0 - 25.0.13 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow-svg-generator | 25.1.0 - 25.1.13 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow-svg-generator | 25.2.0 - 25.2.9 | ≥25.2.10 |
| com.vaadin:vaadin-charts-flow-svg-generator | 25.3.0 | ≥25.3.1 |
com.vaadin:vaadin-core is not listed because Vaadin Charts is not part of Vaadin core. On the 24.4 and 24.7 lines the Charts artifacts carry a patch number of their own, which is why their fixed version differs from the platform one. The 25.0 and 25.1 lines reached end of life without a fixed release, so each has a row of its own ending at the last version published on it, 25.0.13 and 25.1.13 in Maven and 25.0.13 and 25.1.14 in npm, and their users upgrade to the 25.2 line.
| npm package | Vulnerable version | Fixed version |
|---|---|---|
| @vaadin/charts | 22.0.0 - 23.6.6 | ≥23.6.7 |
| @vaadin/charts | 24.0.0 - 24.4.18 | ≥24.4.19 |
| @vaadin/charts | 24.5.0 - 24.7.12 | ≥24.7.13 |
| @vaadin/charts | 24.8.0 - 24.9.18 | ≥24.9.19 |
| @vaadin/charts | 24.10.0 - 24.10.6 | ≥24.10.7 |
| @vaadin/charts | 25.0.0 - 25.0.13 | ≥25.2.14 |
| @vaadin/charts | 25.1.0 - 25.1.14 | ≥25.2.14 |
| @vaadin/charts | 25.2.0 - 25.2.13 | ≥25.2.14 |
| @vaadin/charts | 25.3.0 | ≥25.3.1 |
The npm versions are the web components versions and do not match the Vaadin product versions.
Note for dependency scanners
The fixed versions still depend on highcharts 9.2.2 or 12.2.0, because the fix is a workaround applied when the library loads rather than an upgrade. A scanner that reports those Highcharts versions on a fixed Vaadin version is reporting a vulnerability that the Vaadin fix already neutralises.
References
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c
- https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7
- https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789
- https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
- https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
- https://github.com/vaadin/web-components/pull/12886
- https://github.com/vaadin/flow-components/pull/10283
History
- 2026-10-21: Initial vulnerability report published