Vulnerability	Vulnerable Version
M Prototype Pollution com.vaadin:vaadin is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Prototype Pollution via the `deepMerge` helpers used for chart configuration and component `i18n` in `I18nMixin`. An attacker can write properties onto `Object.prototype`, making them visible on objects throughout the application, by supplying an object with a `__proto__` key that the application merges into a chart configuration or custom `i18n` value. How to fix Prototype Pollution? Upgrade `com.vaadin:vaadin` to version 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 or higher.	[23.0.0,23.6.14)[24.0.0,24.9.21)[24.10.0,24.10.10)[25.0.0,25.1.12)[25.2.0,25.2.7)

Prototype Pollution

com.vaadin:vaadin is a Java framework for modern Java web applications.

Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them visible on objects throughout the application, by supplying an object with a __proto__ key that the application merges into a chart configuration or custom i18n value.

How to fix Prototype Pollution?

Upgrade com.vaadin:vaadin to version 23.6.14, 24.9.21, 24.10.10, 25.1.12, 25.2.7 or higher.

[23.0.0,23.6.14)[24.0.0,24.9.21)[24.10.0,24.10.10)[25.0.0,25.1.12)[25.2.0,25.2.7)

Go back to all versions of this package