CVE-2025-15022: Vaadin vulnerable to Cross-site Scripting

CVE-2025-15022 · Severity: medium · CVSS 4 · Published 2026-01-05

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.

In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.

In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.

Vaadin 14 is not affected as Spreadsheet component was not supported.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6

Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer

Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

Technologies: com.vaadin:vaadin (Maven), com.vaadin:vaadin-server (Maven). Vendors: Maven.

Quick answers

Is CVE-2025-15022 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-15022 being exploited in the wild.
How severe is CVE-2025-15022?
Medium severity, with a CVSS score of 4, published 5 January 2026.
Which products and versions are affected?
com.vaadin:vaadin (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6; com.vaadin:vaadin-server (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.7.50; com.vaadin:vaadin-spreadsheet-flow (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6.
Is there a fix for CVE-2025-15022?
Yes. com.vaadin:vaadin (Maven): upgrade to 23.6.6 or later; com.vaadin:vaadin-server (Maven): upgrade to 7.7.50 or later; com.vaadin:vaadin-spreadsheet-flow (Maven): upgrade to 23.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-15022?
Check whether you run com.vaadin:vaadin (Maven), com.vaadin:vaadin-server (Maven) or com.vaadin:vaadin-spreadsheet-flow (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.vaadin:vaadin (Maven): upgrade to 23.6.6 or later
    # set com.vaadin:vaadin to 23.6.6 in your pom.xml or build.gradle
  • com.vaadin:vaadin-server (Maven): upgrade to 7.7.50 or later
    # set com.vaadin:vaadin-server to 7.7.50 in your pom.xml or build.gradle
  • com.vaadin:vaadin-spreadsheet-flow (Maven): upgrade to 23.6.6 or later
    # set com.vaadin:vaadin-spreadsheet-flow to 23.6.6 in your pom.xml or build.gradle

Affected products

  • com.vaadin:vaadin (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6
  • com.vaadin:vaadin-server (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.7.50
  • com.vaadin:vaadin-spreadsheet-flow (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6

Identifiers

  • CVE-2025-15022
  • GHSA-7wwv-79xw-rvvg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.