Skip to content
OpenAdvisories

Product · vaadin

rich-text-editor

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.1
    CVE-2026-120350

    Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed

    The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared c…

    vaadin vaadin vaadin-core rich-text-editor