CVE-2025-15022

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-15022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-15022
Aliases
Published
2026-01-05T07:52:56.478Z
Modified
2026-07-15T01:49:21.443719332Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber CVSS Calculator
Summary
Cross-site scripting in Action caption
Details

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.

In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.

In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.

Vaadin 14 is not affected as Spreadsheet component was not supported.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6

Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer

Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15022.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.29.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "Vaadin"
}
References

Affected packages

Git / github.com/vaadin/flow-components

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow-components
Events
Introduced
fc0309382457a3595d4b766b40a57ccebca3b2c8
Last affected
4c089cdb9ab79b8e1a695afad3b2ffe8d3c5161b
Introduced
f86528dc71f22a535a8172fafca6fe128d3b89da
Last affected
add045c4556f1675bc8b21b0f85ff55e63c96e1b
Introduced
94061f2f6071796dac17e6401b5ef02de1c2d70a
Last affected
7e640b01bebda2abb179726bf969d3f1366d0365
Database specific 
{
    "extracted_events": [
        {
            "introduced": "23.1.0"
        },
        {
            "last_affected": "23.6.5"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "last_affected": "24.8.13"
        },
        {
            "introduced": "24.9.0"
        },
        {
            "last_affected": "24.9.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

24.*
24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15022.json"

Git / github.com/vaadin/framework

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/framework
Events
Introduced
b29ce01468ed115e942105986da362d665408033
Last affected
77d82854499955858c5db429b4ae8c8d6b28684e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.7.49"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15022.json"