com.vaadin:vaadin-charts-flow 24.10.5

Direct Vulnerabilities

Known vulnerabilities in the com.vaadin:vaadin-charts-flow package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution via the `deepMerge` helpers used for chart configuration and component `i18n` in `I18nMixin`. An attacker can write properties onto `Object.prototype`, making them visible on objects throughout the application, by supplying an object with a `__proto__` key that the application merges into a chart configuration or custom `i18n` value. How to fix Prototype Pollution? Upgrade `com.vaadin:vaadin-charts-flow` to version 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 or higher.	[23.0.0,23.6.14)[24.0.0,24.9.21)[24.10.0,24.10.10)[25.0.0,25.1.12)[25.2.0,25.2.7)
H Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as `additionalOptions`, `updateConfiguration`, or text fields that accept markup. This can lead to unauthorized actions or data exposure if user-controlled input is not properly sanitized. How to fix Cross-site Scripting (XSS)? Upgrade `com.vaadin:vaadin-charts-flow` to version 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or higher.	[22.0.0,23.6.16)[24.0.0,24.4.24)[24.5.0,24.7.15)[24.8.0,24.9.23)[24.10.0,24.10.11)[25.0.0,25.2.10)[25.3.0,25.3.1)

Vulnerability

Vulnerable Version

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them visible on objects throughout the application, by supplying an object with a __proto__ key that the application merges into a chart configuration or custom i18n value.

How to fix Prototype Pollution?

Upgrade com.vaadin:vaadin-charts-flow to version 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 or higher.

[23.0.0,23.6.14)[24.0.0,24.9.21)[24.10.0,24.10.10)[25.0.0,25.1.12)[25.2.0,25.2.7)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions, updateConfiguration, or text fields that accept markup. This can lead to unauthorized actions or data exposure if user-controlled input is not properly sanitized.

How to fix Cross-site Scripting (XSS)?

Upgrade com.vaadin:vaadin-charts-flow to version 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or higher.

[22.0.0,23.6.16)[24.0.0,24.4.24)[24.5.0,24.7.15)[24.8.0,24.9.23)[24.10.0,24.10.11)[25.0.0,25.2.10)[25.3.0,25.3.1)

com.vaadin:vaadin-charts-flow@24.10.5

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically