GHSA-j8mx-j73w-9mxw

Suggest an improvement
Source
https://github.com/advisories/GHSA-j8mx-j73w-9mxw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j8mx-j73w-9mxw
Aliases
Published
2026-05-19T12:31:42Z
Modified
2026-06-04T18:56:25Z
Severity
  • 1.6 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green CVSS Calculator
Summary
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
Details

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Mitigation
Vaadin 23.0.0 - 23.6.10 Upgrade to 23.6.11
Vaadin 24.0.0 - 24.9.17 Upgrade to 24.9.18
Vaadin 24.10.0 - 24.10.3 Upgrade to 24.10.4
Vaadin 25.0.0 - 25.0.11 Upgrade to 25.0.12
Vaadin 25.1.0 - 25.1.4 Upgrade to 25.1.5 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.

Maven coordinates Vulnerable version Fixed version
com.vaadin:flow-plugin-base 23.0.0 - 23.6.10 ≥ 23.6.11
com.vaadin:flow-plugin-base 24.0.0 - 24.9.17 ≥ 24.9.18
com.vaadin:flow-plugin-base 24.0.0 - 24.10.3 ≥ 24.10.4
com.vaadin:flow-plugin-base 25.0.0 - 25.0.11 ≥ 25.0.12
com.vaadin:flow-plugin-base 25.1.0 - 25.1.4 ≥ 25.1.5
com.vaadin:flow-maven-plugin 23.0.0 - 23.6.10 ≥ 23.6.11
com.vaadin:flow-maven-plugin 24.0.0 - 24.9.17 ≥ 24.9.18
com.vaadin:flow-maven-plugin 24.0.0 - 24.10.3 ≥ 24.10.4
com.vaadin:flow-maven-plugin 25.0.0 - 25.0.11 ≥ 25.0.12
com.vaadin:flow-maven-plugin 25.1.0 - 25.1.4 ≥ 25.1.5
com.vaadin:flow-gradle-plugin 24.0.0 - 24.9.17 ≥ 24.9.18
com.vaadin:flow-gradle-plugin 24.0.0 - 24.10.3 ≥ 24.10.4
com.vaadin:flow-gradle-plugin 25.0.0 - 25.0.11 ≥ 25.0.12
com.vaadin:flow-gradle-plugin 25.1.0 - 25.1.4 ≥ 25.1.5
Database specific 
{
    "cwe_ids": [
        "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T18:38:34Z",
    "nvd_published_at": "2026-05-19T12:16:19Z",
    "severity": "LOW"
}
References

Affected packages

Maven
com.vaadin:flow-plugins

Package

Name
com.vaadin:flow-plugins
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-plugins

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.0.0
Fixed
23.6.11

Affected versions

23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.0.9
23.0.10
23.0.11
23.0.12
23.0.13
23.0.14
23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.5
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.4.0
23.4.1
23.4.2
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.6.0
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5
23.6.6
23.6.7
23.6.8
23.6.9
23.6.10

Database specific

last_known_affected_version_range 
"< 23.6.10"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-plugins

Package

Name
com.vaadin:flow-plugins
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-plugins

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.9.18

Affected versions

24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.0.15
24.0.16
24.0.17
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.1.17
24.1.18
24.1.19
24.1.20
24.1.21
24.1.22
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.2.13
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.3.21
24.3.22
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.5.15
24.5.16
24.5.17
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.6.13
24.6.14
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6
24.7.7
24.7.8
24.7.9
24.7.10
24.7.11
24.7.12
24.7.13
24.7.14
24.8.0
24.8.1
24.8.2
24.8.3
24.8.4
24.8.5
24.8.6
24.8.7
24.8.8
24.8.9
24.8.10
24.8.11
24.8.12
24.8.13
24.8.14
24.8.15
24.8.16
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
24.9.8
24.9.9
24.9.10
24.9.11
24.9.12
24.9.13
24.9.14
24.9.15
24.9.16
24.9.17

Database specific

last_known_affected_version_range 
"< 24.9.17"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-plugins

Package

Name
com.vaadin:flow-plugins
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-plugins

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.10.0
Fixed
24.10.4

Affected versions

24.*
24.10.0
24.10.1
24.10.2
24.10.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-plugins

Package

Name
com.vaadin:flow-plugins
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-plugins

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.0.0
Fixed
25.0.12

Affected versions

25.*
25.0.0
25.0.1
25.0.2
25.0.3
25.0.4
25.0.5
25.0.6
25.0.7
25.0.8
25.0.9
25.0.10
25.0.11

Database specific

last_known_affected_version_range 
"< 25.0.11"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-plugins

Package

Name
com.vaadin:flow-plugins
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-plugins

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.1.0
Fixed
25.1.5

Affected versions

25.*
25.1.0
25.1.1
25.1.2
25.1.3
25.1.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-maven-plugin

Package

Name
com.vaadin:flow-maven-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-maven-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
23.0.0
Fixed
23.6.11

Affected versions

23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
23.0.8
23.0.9
23.0.10
23.0.11
23.0.12
23.0.13
23.0.14
23.1.0
23.1.1
23.1.2
23.1.3
23.1.4
23.1.5
23.1.6
23.1.7
23.1.8
23.1.9
23.1.10
23.1.11
23.1.12
23.2.0
23.2.1
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.2.7
23.2.8
23.2.9
23.2.10
23.2.11
23.3.0
23.3.1
23.3.2
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.27
23.3.28
23.3.29
23.3.30
23.3.31
23.4.0
23.4.1
23.4.2
23.5.0
23.5.1
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.5.10
23.5.11
23.5.12
23.5.13
23.6.0
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5
23.6.6
23.6.7
23.6.8
23.6.9
23.6.10

Database specific

last_known_affected_version_range 
"< 23.6.10"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-maven-plugin

Package

Name
com.vaadin:flow-maven-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-maven-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.9.18

Affected versions

24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.0.15
24.0.16
24.0.17
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.1.17
24.1.18
24.1.19
24.1.20
24.1.21
24.1.22
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.2.13
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.3.21
24.3.22
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.5.15
24.5.16
24.5.17
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.6.13
24.6.14
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6
24.7.7
24.7.8
24.7.9
24.7.10
24.7.11
24.7.12
24.7.13
24.7.14
24.8.0
24.8.1
24.8.2
24.8.3
24.8.4
24.8.5
24.8.6
24.8.7
24.8.8
24.8.9
24.8.10
24.8.11
24.8.12
24.8.13
24.8.14
24.8.15
24.8.16
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
24.9.8
24.9.9
24.9.10
24.9.11
24.9.12
24.9.13
24.9.14
24.9.15
24.9.16
24.9.17

Database specific

last_known_affected_version_range 
"< 24.9.17"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-maven-plugin

Package

Name
com.vaadin:flow-maven-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-maven-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.10.0
Fixed
24.10.4

Affected versions

24.*
24.10.0
24.10.1
24.10.2
24.10.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-maven-plugin

Package

Name
com.vaadin:flow-maven-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-maven-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.0.0
Fixed
25.0.12

Affected versions

25.*
25.0.0
25.0.1
25.0.2
25.0.3
25.0.4
25.0.5
25.0.6
25.0.7
25.0.8
25.0.9
25.0.10
25.0.11

Database specific

last_known_affected_version_range 
"< 25.0.11"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-maven-plugin

Package

Name
com.vaadin:flow-maven-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-maven-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.1.0
Fixed
25.1.5

Affected versions

25.*
25.1.0
25.1.1
25.1.2
25.1.3
25.1.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-gradle-plugin

Package

Name
com.vaadin:flow-gradle-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-gradle-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.0.0
Fixed
24.9.18

Affected versions

24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.0.10
24.0.11
24.0.12
24.0.13
24.0.14
24.0.15
24.0.16
24.0.17
24.1.0
24.1.1
24.1.2
24.1.3
24.1.4
24.1.5
24.1.6
24.1.7
24.1.8
24.1.9
24.1.10
24.1.11
24.1.12
24.1.13
24.1.14
24.1.15
24.1.16
24.1.17
24.1.18
24.1.19
24.1.20
24.1.21
24.1.22
24.2.0
24.2.1
24.2.2
24.2.3
24.2.4
24.2.5
24.2.6
24.2.7
24.2.8
24.2.9
24.2.10
24.2.11
24.2.12
24.2.13
24.3.0
24.3.1
24.3.2
24.3.3
24.3.4
24.3.5
24.3.6
24.3.7
24.3.8
24.3.9
24.3.10
24.3.11
24.3.12
24.3.13
24.3.14
24.3.15
24.3.16
24.3.17
24.3.18
24.3.19
24.3.20
24.3.21
24.3.22
24.4.0
24.4.1
24.4.2
24.4.3
24.4.4
24.4.5
24.4.6
24.4.7
24.4.8
24.4.9
24.4.10
24.4.11
24.4.12
24.4.13
24.4.14
24.4.15
24.4.16
24.4.17
24.5.0
24.5.1
24.5.2
24.5.3
24.5.4
24.5.5
24.5.6
24.5.7
24.5.8
24.5.9
24.5.10
24.5.11
24.5.12
24.5.13
24.5.14
24.5.15
24.5.16
24.5.17
24.6.0
24.6.1
24.6.2
24.6.3
24.6.4
24.6.5
24.6.6
24.6.7
24.6.8
24.6.9
24.6.10
24.6.11
24.6.12
24.6.13
24.6.14
24.7.0
24.7.1
24.7.2
24.7.3
24.7.4
24.7.5
24.7.6
24.7.7
24.7.8
24.7.9
24.7.10
24.7.11
24.7.12
24.7.13
24.7.14
24.8.0.alpha10
24.8.0.alpha11
24.8.0.alpha12
24.8.0.alpha13
24.8.0.alpha14
24.8.0.alpha15
24.8.0.beta1
24.8.0.beta2
24.8.0.beta3
24.8.0.beta4
24.8.0.rc1
24.8.0.rc2
24.8.0
24.8.1
24.8.2
24.8.3
24.8.4
24.8.5
24.8.6
24.8.7
24.8.8
24.8.9
24.8.10
24.8.11
24.8.12
24.8.13
24.8.14
24.8.15
24.8.16
24.9.0-alpha1
24.9.0-alpha2
24.9.0-alpha3
24.9.0-alpha4
24.9.0-alpha5
24.9.0-alpha6
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.0
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
24.9.8
24.9.9
24.9.10
24.9.11
24.9.12
24.9.13
24.9.14
24.9.15
24.9.16
24.9.17

Database specific

last_known_affected_version_range 
"< 24.9.17"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-gradle-plugin

Package

Name
com.vaadin:flow-gradle-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-gradle-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
24.10.0
Fixed
24.10.4

Affected versions

24.*
24.10.0
24.10.1
24.10.2
24.10.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-gradle-plugin

Package

Name
com.vaadin:flow-gradle-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-gradle-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.0.0
Fixed
25.0.12

Affected versions

25.*
25.0.0
25.0.1
25.0.2
25.0.3
25.0.4
25.0.5
25.0.6
25.0.7
25.0.8
25.0.9
25.0.10
25.0.11

Database specific

last_known_affected_version_range 
"< 25.0.11"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"
com.vaadin:flow-gradle-plugin

Package

Name
com.vaadin:flow-gradle-plugin
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-gradle-plugin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
25.1.0
Fixed
25.1.5

Affected versions

25.*
25.1.0
25.1.1
25.1.2
25.1.3
25.1.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8mx-j73w-9mxw/GHSA-j8mx-j73w-9mxw.json"