{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "22.0.0"
                  },
                  {
                    "fixed": "23.6.16"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "22.0.0"
                  },
                  {
                    "fixed": "23.6.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.0.0"
                  },
                  {
                    "fixed": "24.4.24"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.0.0"
                  },
                  {
                    "fixed": "24.4.19"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.5.0"
                  },
                  {
                    "fixed": "24.7.16"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.5.0"
                  },
                  {
                    "fixed": "24.7.15"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.5.0"
                  },
                  {
                    "fixed": "24.7.13"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.8.0"
                  },
                  {
                    "fixed": "24.9.23"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.8.0"
                  },
                  {
                    "fixed": "24.9.19"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.10.0"
                  },
                  {
                    "fixed": "24.10.11"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "24.10.0"
                  },
                  {
                    "fixed": "24.10.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "25.0.0"
                  },
                  {
                    "last_affected": "25.0.13"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "25.1.0"
                  },
                  {
                    "last_affected": "25.1.13"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "25.2.0"
                  },
                  {
                    "fixed": "25.2.10"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "25.3.0"
                  },
                  {
                    "fixed": "25.3.1"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "21.0.0"
                  },
                  {
                    "fixed": "23.6.16"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          },
          "events": [
            {
              "introduced": "5109586258202cb21d1f6056befac582ef540f5e"
            },
            {
              "fixed": "46f323d443fe0160908347885f70ca5869134558"
            },
            {
              "fixed": "c8a125b0dff0360fe1c503565066b5bf9f6fae0a"
            },
            {
              "introduced": "f86528dc71f22a535a8172fafca6fe128d3b89da"
            },
            {
              "fixed": "f741453f5b9f4aacf385968d2f441d5ad17cf3e8"
            },
            {
              "fixed": "5deb5b27dae3e959ad509d7c07c61efffb857d7f"
            },
            {
              "introduced": "0c9e8d08a37ae4ae0540fca43e5b7298f02ebc35"
            },
            {
              "fixed": "0d4daea11d4dc994f7f40f6501e58c27ebe2b0cc"
            },
            {
              "fixed": "f09f71774f286688e79fffb03273c5942ea90944"
            },
            {
              "introduced": "cd2abc331a6333c36173ba3ade40a86c94394eec"
            },
            {
              "fixed": "0c9bded4fa43fe3dd342c9f58626f08b2bcc99c7"
            },
            {
              "fixed": "fda5dcfd5decbcd10bbc2a08328990e418a443e3"
            },
            {
              "introduced": "ffc51a5b98b21f3a15191039050e9d8a8bf464cf"
            },
            {
              "fixed": "eeaf61bded8b0ccc552f15e1e3b73e79b2c0c2ce"
            },
            {
              "fixed": "0baee35a4af935fe512ab85590bdcc3512001acc"
            },
            {
              "introduced": "2099b3c966835d8e2677c1d638bc3624ebbb8c87"
            },
            {
              "last_affected": "72958e91e3f010cfee91c6c4db2558c7f9026d44"
            },
            {
              "introduced": "620e7da4e7a5771152ee15c131bcf2a93b026d14"
            },
            {
              "last_affected": "47cf689e61827dc711be69dba6a9d8d04b74a375"
            },
            {
              "introduced": "2aa7290bdb7e8bff78ec91334627c2ed852539dc"
            },
            {
              "fixed": "f2f90402e6e538e3eaab28b65019f216ebae88c6"
            },
            {
              "introduced": "ffae7c4339957ea7606af8f17c7cb2513642690b"
            },
            {
              "fixed": "0f8133b8f20e330c72f6f84bdb03f721196a5671"
            },
            {
              "introduced": "592b53c6e24275c52ab857780c8ae697a46aae47"
            },
            {
              "fixed": "46f323d443fe0160908347885f70ca5869134558"
            }
          ],
          "repo": "https://github.com/vaadin/flow-components",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "25.1.0"
                  },
                  {
                    "last_affected": "25.1.14"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              },
              {
                "range": [
                  {
                    "introduced": "25.2.0"
                  },
                  {
                    "fixed": "25.2.14"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          },
          "events": [
            {
              "introduced": "dab1861c10002b1d191b6a37f55e574e0b470ca5"
            },
            {
              "last_affected": "e1e68f0783c9b6c50ac194086d15e5ca91d00d24"
            },
            {
              "introduced": "f4aa4498fd81ba46a1f03507c104c599f5c85cb7"
            },
            {
              "fixed": "7f2566cacb4ca4f83c44fbcc79776b4a3aa0823e"
            }
          ],
          "repo": "https://github.com/vaadin/web-components",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Vaadin",
    "cwe_ids": [
      "CWE-1321",
      "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107588.json"
  },
  "details": "Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 22.0.0 - 23.6.15\nVaadin 24.0.0 - 24.4.23\nVaadin 24.5.0 - 24.7.15\nVaadin 24.8.0 - 24.9.22\nVaadin 24.10.0 - 24.10.10\nVaadin 25.0.0 - 25.2.9\nVaadin 25.3.0\n\nMitigation\nUpgrade to 23.6.16\nUpgrade to 24.4.24\nUpgrade to 24.7.16\nUpgrade to 24.9.23\nUpgrade to 24.10.11\nUpgrade to 25.2.10\nUpgrade to 25.3.1 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin / 22.0.0 - 23.6.15 / \u003e=23.6.16\ncom.vaadin:vaadin / 24.0.0 - 24.4.23 / \u003e=24.4.24\ncom.vaadin:vaadin / 24.5.0 - 24.7.15 / \u003e=24.7.16\ncom.vaadin:vaadin / 24.8.0 - 24.9.22 / \u003e=24.9.23\ncom.vaadin:vaadin / 24.10.0 - 24.10.10 / \u003e=24.10.11\ncom.vaadin:vaadin / 25.0.0 - 25.0.13 / \u003e=25.2.10\ncom.vaadin:vaadin / 25.1.0 - 25.1.13 / \u003e=25.2.10\ncom.vaadin:vaadin / 25.2.0 - 25.2.9 / \u003e=25.2.10\ncom.vaadin:vaadin / 25.3.0 / \u003e=25.3.1\ncom.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / \u003e=23.6.16\ncom.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / \u003e=24.4.24\ncom.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / \u003e=24.7.15\ncom.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / \u003e=24.9.23\ncom.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / \u003e=24.10.11\ncom.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow / 25.3.0 / \u003e=25.3.1\ncom.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / \u003e=23.6.16\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / \u003e=24.4.24\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / \u003e=24.7.15\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / \u003e=24.9.23\ncom.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / \u003e=24.10.11\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / \u003e=25.2.10\ncom.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / \u003e=25.3.1\n\nnpm packages\nnpm package / Vulnerable versions / Fixed version\n@vaadin/charts / 22.0.0 - 23.6.6 / \u003e=23.6.7\n@vaadin/charts / 24.0.0 - 24.4.18 / \u003e=24.4.19\n@vaadin/charts / 24.5.0 - 24.7.12 / \u003e=24.7.13\n@vaadin/charts / 24.8.0 - 24.9.18 / \u003e=24.9.19\n@vaadin/charts / 24.10.0 - 24.10.6 / \u003e=24.10.7\n@vaadin/charts / 25.0.0 - 25.0.13 / \u003e=25.2.14\n@vaadin/charts / 25.1.0 - 25.1.14 / \u003e=25.2.14\n@vaadin/charts / 25.2.0 - 25.2.13 / \u003e=25.2.14\n@vaadin/charts / 25.3.0 / \u003e=25.3.1",
  "id": "CVE-2026-107588",
  "modified": "2026-10-22T02:30:18.911208706Z",
  "published": "2026-10-21T18:22:47.593Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107588.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/flow-components"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10283"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10284"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10285"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10290"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10291"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10292"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10293"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10299"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/flow-components/pull/10300"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/platform"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vaadin/web-components"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12886"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12887"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12897"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12898"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12899"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12900"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12901"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12918"
    },
    {
      "type": "FIX",
      "url": "https://github.com/vaadin/web-components/pull/12919"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107588"
    },
    {
      "type": "WEB",
      "url": "https://registry.npmjs.org"
    },
    {
      "type": "WEB",
      "url": "https://repo.maven.apache.org/maven2"
    },
    {
      "type": "WEB",
      "url": "https://vaadin.com/security/cve-2026-107588"
    }
  ],
  "related": [
    "GHSA-35rr-xwfh-x789",
    "GHSA-5793-x2q3-c3q7",
    "GHSA-65hg-cf3f-5m39",
    "GHSA-gfvx-2c2g-38wq",
    "GHSA-mw4f-gj5x-6xr4",
    "GHSA-rmqc-xvr3-v46c"
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts"
}