Executive brief
A security issue in Vaadin's build tools for Maven and Gradle can cause sensitive information to be leaked. When a frontend build fails, the software may write all system environment variables—which often include passwords, API keys, and other secrets—into publicly accessible build logs or CI/CD archives. This could allow unauthorized individuals with access to these logs to steal credentials and compromise other systems.
Technical details
An information disclosure vulnerability (CWE-209) exists in the Vaadin Maven and Gradle plugins. The vulnerability is triggered when the frontend build process (e.g., Vite) exits with a non-zero status, causing the plugin to dump the full set of environment variables into the build logs. In CI/CD environments, these variables frequently contain sensitive secrets such as credentials, tokens, or private keys. If these logs are archived or accessible to unauthorized users, those secrets are exposed in clear text. The issue was addressed by replacing the 'zt-exec' dependency with 'java.lang.ProcessBuilder' and improving error handling. Patches are available in versions 23.6.11, 24.9.18, 24.10.4, 25.0.12, and 25.1.5.
Affected products
- Vaadin flow-maven-plugin 23.0.0 - 23.6.10, 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4
- Vaadin flow-gradle-plugin 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4
- Vaadin flow-plugin-base 23.0.0 - 23.6.10, 24.0.0 - 24.9.17, 24.10.0 - 24.10.3, 25.0.0 - 25.0.11, 25.1.0 - 25.1.4
Timeline
- 2026-04-30: patched: Pull request to remove zt-exec dependency merged
- 2026-05-19: disclosed: Initial advisory publication
- 2026-06-04: advisory: Advisory reviewed and updated