Vaadin: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 6.3
  CVE-2026-91860

  Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

  A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, ma…

  vaadin vaadin vaadin-core vaadin-charts-flow
  Sep 30, 2026
• Medium 5.3
  CVE-2026-93547

  Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

  A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a c…

  vaadin vaadin vaadin-spreadsheet-flow vaadin-spreadsheet
  Sep 30, 2026

Revision history

1. 2026-09-30 #1

   Initiale Fassung

References

• Vaadin Security Advisory vom 2026-09-30
  https://vaadin.com/security/cve-2026-93547
• Vaadin Security Advisory vom 2026-09-30
  https://vaadin.com/security/cve-2026-91860