# CVE-2025-15022: Vaadin vulnerable to Cross-site Scripting

Source: https://junglewise.ai/threats/cve-2025-15022-vaadin-vulnerable-to-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-05  
License: CC BY 4.0 with a link back

CVE-2025-15022 · Severity: medium · CVSS 4 · Published 2026-01-05

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.

In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.

In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.

Vaadin 14 is not affected as Spreadsheet component was not supported.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 7.0.0 - 7.7.49
Vaadin 8.0.0 - 8.29.1
Vaadin 23.1.0 - 23.6.5
Vaadin 24.0.0 - 24.8.13
Vaadin 24.9.0 - 24.9.6

Mitigation
Upgrade to 7.7.50
Upgrade to 8.30.0
Upgrade to 23.6.6
Upgrade to 24.8.14 or 24.9.7
Upgrade to 25.0.0 or newer

Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server
7.0.0 - 7.7.49
≥7.7.50
com.vaadin:vaadin-server
8.0.0 - 8.29.1
≥8.30.0
com.vaadin:vaadin
23.1.0 - 23.6.5
≥23.6.6
com.vaadin:vaadin24.0.0 - 24.8.13
≥24.8.14
com.vaadin:vaadin24.9.0 - 24.9.6
≥24.9.7
com.vaadin:vaadin-spreadsheet-flow
23.1.0 - 23.6.5
≥23.6.6
com.vaadin:vaadin-spreadsheet-flow
24.0.0 - 24.8.13
≥24.8.14
com.vaadin:vaadin-spreadsheet-flow
24.9.0 - 24.9.6
≥24.9.7

Technologies: [com.vaadin:vaadin (Maven)](https://junglewise.ai/threats/technologies/com-vaadin-vaadin), [com.vaadin:vaadin-server (Maven)](https://junglewise.ai/threats/technologies/com-vaadin-vaadin-server). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-15022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15022 being exploited in the wild.

**How severe is CVE-2025-15022?** Medium severity, with a CVSS score of 4, published 5 January 2026.

**Which products and versions are affected?** com.vaadin:vaadin (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6; com.vaadin:vaadin-server (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.7.50; com.vaadin:vaadin-spreadsheet-flow (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6.

**Is there a fix for CVE-2025-15022?** Yes. com.vaadin:vaadin (Maven): upgrade to 23.6.6 or later; com.vaadin:vaadin-server (Maven): upgrade to 7.7.50 or later; com.vaadin:vaadin-spreadsheet-flow (Maven): upgrade to 23.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-15022?** Check whether you run com.vaadin:vaadin (Maven), com.vaadin:vaadin-server (Maven) or com.vaadin:vaadin-spreadsheet-flow (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.vaadin:vaadin (Maven): upgrade to 23.6.6 or later

  ```sh
  # set com.vaadin:vaadin to 23.6.6 in your pom.xml or build.gradle
  ```

- com.vaadin:vaadin-server (Maven): upgrade to 7.7.50 or later

  ```sh
  # set com.vaadin:vaadin-server to 7.7.50 in your pom.xml or build.gradle
  ```

- com.vaadin:vaadin-spreadsheet-flow (Maven): upgrade to 23.6.6 or later

  ```sh
  # set com.vaadin:vaadin-spreadsheet-flow to 23.6.6 in your pom.xml or build.gradle
  ```


## Affected products

- com.vaadin:vaadin (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6
- com.vaadin:vaadin-server (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.7.50
- com.vaadin:vaadin-spreadsheet-flow (Maven) ECOSYSTEM:introduced=23.1.0,fixed=23.6.6

## Identifiers

- CVE-2025-15022
- GHSA-7wwv-79xw-rvvg

## Related threats

- [Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash](https://junglewise.ai/threats/cve-2026-2742-vaadin-vulnerable-to-authentication-bypass-when-accessing-the)
- [Vaadin Platform possible file bypass via upload validation on the server-side](https://junglewise.ai/threats/vaadin-platform-possible-file-bypass-via-upload-validation-on-the-b78af9e4)
- [Vaadin Framework possible file bypass via upload validation on the server-side](https://junglewise.ai/threats/cve-2025-9467-vaadin-framework-possible-file-bypass-via-upload-validation-on-the)
- [Vaadin vulnerable to possible information disclosure in non visible components.](https://junglewise.ai/threats/cve-2023-25499-vaadin-vulnerable-to-possible-information-disclosure-in-non)
- [Vaadin vulnerable to possible information disclosure of class and method names in RPC response](https://junglewise.ai/threats/cve-2023-25500-vaadin-vulnerable-to-possible-information-disclosure-of-class-and)