Is CVE-2026-107588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107588 being exploited in the wild.

How severe is CVE-2026-107588?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Vaadin Charts npm: 22.0.0–23.6.6, 24.0.0–24.4.18, 24.5.0–24.7.12, 24.8.0–24.9.18, 24.10.0–24.10.6, 25.0.0–25.2.13, 25.3.0; Vaadin 22.0.0–23.6.15, 24.0.0–24.4.23, 24.5.0–24.7.15, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0; Vaadin Charts Flow 22.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0; Vaadin Charts Flow SVG Generator 21.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0.

How is CVE-2026-107588 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107588?

Check whether you run Vaadin Charts, Vaadin, Vaadin Charts Flow or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107588: Vaadin Charts multiple XSS and prototype pollution in bundled Highcharts

CVE-2026-107588 · Severity: info · Published 2026-10-21

Vaadin Charts is a UI component library that renders interactive charts using a bundled version of the Highcharts library. The library contains multiple cross-site scripting (XSS) vulnerabilities and prototype pollution flaws that can be exploited if an application passes untrusted data into chart configurations. Attackers could inject malicious code that executes in users' browsers or modify core JavaScript objects, potentially leading to account compromise or data theft.

Technologies: Vaadin. Vendors: Vaadin.

Quick answers

Is CVE-2026-107588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107588 being exploited in the wild.
How severe is CVE-2026-107588?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Vaadin Charts npm: 22.0.0–23.6.6, 24.0.0–24.4.18, 24.5.0–24.7.12, 24.8.0–24.9.18, 24.10.0–24.10.6, 25.0.0–25.2.13, 25.3.0; Vaadin 22.0.0–23.6.15, 24.0.0–24.4.23, 24.5.0–24.7.15, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0; Vaadin Charts Flow 22.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0; Vaadin Charts Flow SVG Generator 21.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0.
Is there a fix for CVE-2026-107588?: Yes: fixed in Vaadin 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; Vaadin Charts Flow 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; Vaadin Charts Flow SVG Generator 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; @vaadin/charts (npm) 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14, 25.3.1 or newer. Until then: Validate and sanitize all user-supplied data before passing it to chart configurations, especially through additionalOptions, updateConfiguration(), and text properties that accept markup. Restrict which sources can provide data for chart parameters to prevent attacker-controlled input from reaching the Highcharts configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107588 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107588?: Check whether you run Vaadin Charts, Vaadin, Vaadin Charts Flow or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vaadin 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; Vaadin Charts Flow 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; Vaadin Charts Flow SVG Generator 23.6.16, 24.4.24, 24.7.15, 24.9.23, 24.10.11, 25.2.10, 25.3.1 or newer; @vaadin/charts (npm) 23.6.7, 24.4.19, 24.7.13, 24.9.19, 24.10.7, 25.2.14, 25.3.1 or newer

Validate and sanitize all user-supplied data before passing it to chart configurations, especially through additionalOptions, updateConfiguration(), and text properties that accept markup. Restrict which sources can provide data for chart parameters to prevent attacker-controlled input from reaching the Highcharts configuration.

Technical details

Vaadin Charts bundles specific pinned versions of Highcharts (9.2.2 in versions 22–24, 12.2.0 in version 25) with multiple vulnerabilities including XSS via credits.href, breadcrumbs.style, HTML text parsing during printing, xlink:href attributes in exported charts, and prototype pollution through dotted series.keys paths. These flaws are reachable if untrusted data reaches chart configuration through properties like additionalOptions, updateConfiguration(), or text fields accepting markup. The fixed versions apply Highsoft's recommended mitigations to the bundled Highcharts without version changes.

Affected products

Vaadin Vaadin 22.0.0–23.6.15, 24.0.0–24.4.23, 24.5.0–24.7.15, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0
Vaadin Vaadin Charts Flow 22.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0
Vaadin Vaadin Charts Flow SVG Generator 21.0.0–23.6.15, 24.0.0–24.4.22, 24.5.0–24.7.14, 24.8.0–24.9.22, 24.10.0–24.10.10, 25.0.0–25.2.9, 25.3.0
Vaadin Vaadin Charts npm: 22.0.0–23.6.6, 24.0.0–24.4.18, 24.5.0–24.7.12, 24.8.0–24.9.18, 24.10.0–24.10.6, 25.0.0–25.2.13, 25.3.0

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.