{"id":"GHSA-7wwv-79xw-rvvg","summary":"Vaadin vulnerable to Cross-site Scripting","details":"Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.\n\nIn Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.\n\nIn Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.\n\nVaadin 14 is not affected as Spreadsheet component was not supported.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 7.0.0 - 7.7.49\nVaadin 8.0.0 - 8.29.1\nVaadin 23.1.0 - 23.6.5\nVaadin 24.0.0 - 24.8.13\nVaadin 24.9.0 - 24.9.6\n\nMitigation\nUpgrade to 7.7.50\nUpgrade to 8.30.0\nUpgrade to 23.6.6\nUpgrade to 24.8.14 or 24.9.7\nUpgrade to 25.0.0 or newer\n\nArtifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server\n7.0.0 - 7.7.49\n≥7.7.50\ncom.vaadin:vaadin-server\n8.0.0 - 8.29.1\n≥8.30.0\ncom.vaadin:vaadin\n23.1.0 - 23.6.5\n≥23.6.6\ncom.vaadin:vaadin24.0.0 - 24.8.13\n≥24.8.14\ncom.vaadin:vaadin24.9.0 - 24.9.6\n≥24.9.7\ncom.vaadin:vaadin-spreadsheet-flow\n23.1.0 - 23.6.5\n≥23.6.6\ncom.vaadin:vaadin-spreadsheet-flow\n24.0.0 - 24.8.13\n≥24.8.14\ncom.vaadin:vaadin-spreadsheet-flow\n24.9.0 - 24.9.6\n≥24.9.7","aliases":["CVE-2025-15022"],"modified":"2026-09-10T03:50:33.190776453Z","published":"2026-01-05T09:30:19Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-01-05T19:48:50Z","nvd_published_at":"2026-01-05T08:15:56Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15022"},{"type":"WEB","url":"https://github.com/vaadin/flow-components/pull/8285"},{"type":"WEB","url":"https://github.com/vaadin/flow-components/commit/71046aa3dd08be0907bd03140c33131b94f6e99c"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow-components"},{"type":"WEB","url":"https://vaadin.com/security/cve-2025-15022"}],"affected":[{"package":{"name":"com.vaadin:vaadin-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.7.50"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.1.0","7.1.0.beta1","7.1.1","7.1.10","7.1.11","7.1.12","7.1.13","7.1.14","7.1.15","7.1.2","7.1.3","7.1.4","7.1.5","7.1.6","7.1.7","7.1.8","7.1.9","7.2.0","7.2.0.beta1","7.2.1","7.2.2","7.2.3","7.2.4","7.2.5","7.2.6","7.2.7","7.3.0","7.3.0.alpha1","7.3.0.alpha2","7.3.0.alpha3","7.3.0.beta1","7.3.0.rc1","7.3.1","7.3.10","7.3.2","7.3.3","7.3.4","7.3.5","7.3.6","7.3.7","7.3.8","7.3.9","7.4.0","7.4.0.alpha1","7.4.0.alpha10","7.4.0.alpha11","7.4.0.alpha12","7.4.0.alpha13","7.4.0.alpha14","7.4.0.alpha2","7.4.0.alpha3","7.4.0.alpha4","7.4.0.alpha5","7.4.0.alpha6","7.4.0.alpha7","7.4.0.alpha8","7.4.0.alpha9","7.4.0.beta1","7.4.0.beta2","7.4.0.beta3","7.4.0.rc1","7.4.1","7.4.2","7.4.3","7.4.4","7.4.5","7.4.6","7.4.7","7.4.8","7.5.0","7.5.0.alpha1","7.5.0.beta1","7.5.0.beta2","7.5.0.beta3","7.5.0.rc1","7.5.0.rc2","7.5.1","7.5.10","7.5.2","7.5.3","7.5.4","7.5.5","7.5.6","7.5.7","7.5.8","7.5.9","7.6.0","7.6.0.alpha1","7.6.0.alpha2","7.6.1","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","7.7.0","7.7.1","7.7.10","7.7.11","7.7.12","7.7.13","7.7.14","7.7.15","7.7.16","7.7.17","7.7.2","7.7.23","7.7.24","7.7.25","7.7.26","7.7.27","7.7.28","7.7.29","7.7.3","7.7.30","7.7.31","7.7.32","7.7.33","7.7.34","7.7.35","7.7.36","7.7.37","7.7.38","7.7.39","7.7.4","7.7.40","7.7.41","7.7.42","7.7.43","7.7.44","7.7.45","7.7.46","7.7.47","7.7.48","7.7.49","7.7.5","7.7.6","7.7.7","7.7.8","7.7.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.30.0"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.10.0","8.10.1","8.10.2","8.10.3","8.10.4","8.10.5","8.11.0","8.11.1","8.11.2","8.11.3","8.12.0","8.12.1","8.12.2","8.12.3","8.12.4","8.13.0","8.13.1","8.13.2","8.13.3","8.14.0","8.14.1","8.14.2","8.14.3","8.14.4","8.14.5","8.15.0","8.15.1","8.15.2","8.16.0","8.16.1","8.17.0","8.18.0","8.19.0","8.2.0","8.2.1","8.20.0","8.20.1","8.20.2","8.20.3","8.21.0","8.22.0","8.23.0","8.24.0","8.25.0","8.25.1","8.25.2","8.26.0","8.27.0","8.27.1","8.27.2","8.27.3","8.27.4","8.27.5","8.27.6","8.27.7","8.28.0","8.28.1","8.28.2","8.28.3","8.28.4","8.29.0","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2","8.6.3","8.6.4","8.7.0","8.7.0.beta1","8.7.1","8.7.2","8.8.0","8.8.1","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.9.0","8.9.1","8.9.2","8.9.3","8.9.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.0"},{"fixed":"23.6.6"}]}],"versions":["23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.13","23.1.14","23.1.15","23.1.16","23.1.17","23.1.2","23.1.3","23.1.4","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.12","23.2.13","23.2.14","23.2.15","23.2.16","23.2.17","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.32","23.3.33","23.3.34","23.3.35","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.4.2","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.14","23.5.15","23.5.16","23.5.17","23.5.18","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.2","23.6.3","23.6.4","23.6.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.8.14"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.2","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.18","24.4.19","24.4.2","24.4.20","24.4.21","24.4.22","24.4.23","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.15","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.9.0"},{"fixed":"24.9.7"}]}],"versions":["24.9.0","24.9.1","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin-spreadsheet-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.0"},{"fixed":"23.6.6"}]}],"versions":["23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.13","23.1.14","23.1.15","23.1.16","23.1.17","23.1.2","23.1.3","23.1.4","23.1.5","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.12","23.2.13","23.2.14","23.2.15","23.2.16","23.2.17","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.32","23.3.33","23.3.34","23.3.35","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.14","23.5.15","23.5.16","23.5.17","23.5.18","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.2","23.6.3","23.6.4","23.6.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin-spreadsheet-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.8.14"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.2","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.18","24.4.19","24.4.2","24.4.20","24.4.21","24.4.22","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}},{"package":{"name":"com.vaadin:vaadin-spreadsheet-flow","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.9.0"},{"fixed":"24.9.7"}]}],"versions":["24.9.0","24.9.1","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-7wwv-79xw-rvvg/GHSA-7wwv-79xw-rvvg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}