Prototype Pollution in Vaadin Charts and Component Base

Executive Summary

This is a prototype pollution vulnerability in Vaadin Charts and Component Base. It occurs when merging untrusted objects into chart configurations or component i18n properties. The deep merge process copies properties without filtering prototype chain keys like __proto__, allowing attackers to inject properties into Object.prototype. This makes injected properties visible across the entire application, potentially corrupting logic or enabling further attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability cannot be directly detected via network or system commands as it requires code analysis. Check if your Vaadin application uses vulnerable versions of com.vaadin:vaadin, com.vaadin:vaadin-core, com.vaadin:vaadin-charts-flow, @vaadin/charts, or @vaadin/component-base by inspecting dependency versions in your project files.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can corrupt application logic, cause denial of service, or serve as a vector for further attacks. It specifically affects applications that assign externally sourced objects to i18n properties, chart configurations, or updateConfiguration() in charts. Attackers could manipulate application behavior or access sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Vaadin components to fixed versions: Vaadin 23.6.14+, 24.9.21+, 24.10.10+, 25.1.12+, or 25.2.7+.
• For npm packages, upgrade to @vaadin/charts >=23.6.5, >=24.9.18, >=24.10.5, >=25.1.12, or >=25.2.9 and @vaadin/component-base >=24.9.18, >=24.10.5, >=25.1.12, or >=25.2.9.
• Review application code for usage of i18n properties, chart configuration, or updateConfiguration() methods that merge untrusted input.

Useful 0 Not Useful 0