GHSA-7wwv-79xw-rvvg

Suggest an improvement
Source
https://github.com/advisories/GHSA-7wwv-79xw-rvvg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7wwv-79xw-rvvg
Aliases
  • CVE-2025-15022
Published
2026-01-05T09:30:19Z
Modified
2026-01-05T20:41:23.756025Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Vaadin vulnerable to Cross-site Scripting
Details

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.

In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.

In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.

Vaadin 14 is not affected as Spreadsheet component was not supported.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6

Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer

Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

Database specific 
{
    "severity": "MODERATE",
    "github_reviewed_at": "2026-01-05T19:48:50Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": "2026-01-05T08:15:56Z",
    "github_reviewed": true
}
References

Affected packages

Maven

com.vaadin:vaadin-server

Package

Name
com.vaadin:vaadin-server
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0.0
Fixed
7.7.50

Affected versions

7.*

7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.1.0.beta1
7.1.0
7.1.1
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.2.0.beta1
7.2.0
7.2.1
7.2.2
7.2.3
7.2.4
7.2.5
7.2.6
7.2.7
7.3.0.alpha1
7.3.0.alpha2
7.3.0.alpha3
7.3.0.beta1
7.3.0.rc1
7.3.0
7.3.1
7.3.2
7.3.3
7.3.4
7.3.5
7.3.6
7.3.7
7.3.8
7.3.9
7.3.10
7.4.0.alpha1
7.4.0.alpha2
7.4.0.alpha3
7.4.0.alpha4
7.4.0.alpha5
7.4.0.alpha6
7.4.0.alpha7
7.4.0.alpha8
7.4.0.alpha9
7.4.0.alpha10
7.4.0.alpha11
7.4.0.alpha12
7.4.0.alpha13
7.4.0.alpha14
7.4.0.beta1
7.4.0.beta2
7.4.0.beta3
7.4.0.rc1
7.4.0
7.4.1
7.4.2
7.4.3
7.4.4
7.4.5
7.4.6
7.4.7
7.4.8
7.5.0.alpha1
7.5.0.beta1
7.5.0.beta2
7.5.0.beta3
7.5.0.rc1
7.5.0.rc2
7.5.0
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
7.5.7
7.5.8
7.5.9
7.5.10
7.6.0.alpha1
7.6.0.alpha2
7.6.0
7.6.1
7.6.2
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.7.0
7.7.1
7.7.2
7.7.3
7.7.4
7.7.5
7.7.6
7.7.7
7.7.8
7.7.9
7.7.10
7.7.11
7.7.12
7.7.13
7.7.14
7.7.15
7.7.16
7.7.17
7.7.23
7.7.24
7.7.25
7.7.26
7.7.27
7.7.28
7.7.29
7.7.30
7.7.31
7.7.32
7.7.33
7.7.34
7.7.35
7.7.36
7.7.37
7.7.38
7.7.39
7.7.40
7.7.41
7.7.42
7.7.43
7.7.44
7.7.45
7.7.46
7.7.47
7.7.48
7.7.49

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin-server

Package

Name
com.vaadin:vaadin-server
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0.0
Fixed
8.30.0

Affected versions

8.*

8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
8.1.6
8.1.7
8.1.8
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.4.0
8.4.1
8.4.2
8.4.3
8.4.4
8.4.5
8.5.0
8.5.1
8.5.2
8.6.0
8.6.1
8.6.2
8.6.3
8.6.4
8.7.0.beta1
8.7.0
8.7.1
8.7.2
8.8.0
8.8.1
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.9.0
8.9.1
8.9.2
8.9.3
8.9.4
8.10.0
8.10.1
8.10.2
8.10.3
8.10.4
8.10.5
8.11.0
8.11.1
8.11.2
8.11.3
8.12.0
8.12.1
8.12.2
8.12.3
8.12.4
8.13.0
8.13.1
8.13.2
8.13.3
8.14.0
8.14.1
8.14.2
8.14.3
8.14.4
8.15.0
8.15.1
8.15.2
8.16.0
8.16.1
8.17.0
8.18.0
8.19.0
8.20.0
8.20.1
8.20.2
8.20.3
8.21.0
8.22.0
8.23.0
8.24.0
8.25.0
8.25.1
8.25.2
8.26.0
8.27.0
8.27.1
8.27.2
8.27.3
8.27.4
8.27.5
8.27.6
8.27.7
8.28.0
8.28.1
8.28.2
8.28.3
8.28.4
8.29.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.1.0
Fixed
23.6.6

Affected versions

23.*

23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.1.13
23.1.14
23.1.15
23.1.16
23.1.17
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.2.12
23.2.13
23.2.14
23.2.15
23.2.16
23.2.17
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.3.32
23.3.33
23.3.34
23.3.35
23.4.0
23.4.1
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.16
23.5.17
23.5.18
23.6.0
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.8.14

Affected versions

24.*

24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.4.18
24.4.19
24.4.20
24.4.21
24.4.22
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6
24.7.7
24.7.8
24.7.9
24.7.10
24.7.11
24.7.12
24.7.13
24.7.14
24.8.0
24.8.1
24.8.2
24.8.3
24.8.4
24.8.5
24.8.6
24.8.7
24.8.8
24.8.9
24.8.10
24.8.11
24.8.12
24.8.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin

Package

Name
com.vaadin:vaadin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.9.0
Fixed
24.9.7

Affected versions

24.*

24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin-spreadsheet-flow

Package

Name
com.vaadin:vaadin-spreadsheet-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-spreadsheet-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.1.0
Fixed
23.6.6

Affected versions

23.*

23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.5
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.1.13
23.1.14
23.1.15
23.1.16
23.1.17
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.2.12
23.2.13
23.2.14
23.2.15
23.2.16
23.2.17
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.3.32
23.3.33
23.3.34
23.3.35
23.4.0
23.4.1
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.16
23.5.17
23.5.18
23.6.0
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin-spreadsheet-flow

Package

Name
com.vaadin:vaadin-spreadsheet-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-spreadsheet-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.8.14

Affected versions

24.*

24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.4.18
24.4.19
24.4.20
24.4.21
24.4.22
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6
24.7.7
24.7.8
24.7.9
24.7.10
24.7.11
24.7.12
24.7.13
24.7.14
24.8.0
24.8.1
24.8.2
24.8.3
24.8.4
24.8.5
24.8.6
24.8.7
24.8.8
24.8.9
24.8.10
24.8.11
24.8.12
24.8.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"

com.vaadin:vaadin-spreadsheet-flow

Package

Name
com.vaadin:vaadin-spreadsheet-flow
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-spreadsheet-flow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.9.0
Fixed
24.9.7

Affected versions

24.*

24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"