vaadin/vaadin-spreadsheet-flow up to 24.9.6 cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in vaadin and vaadin-spreadsheet-flow up to 7.7.49/8.29.1/23.6.5/24.8.13/24.9.6. This impacts an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2025-15022. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in vaadin and vaadin-spreadsheet-flow up to 7.7.49/8.29.1/23.6.5/24.8.13/24.9.6. It has been classified as problematic. This affects some unknown processing. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility. In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist. Vaadin 14 is not affected as Spreadsheet component was not supported. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6 Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer Artifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

The advisory is shared at vaadin.com. This vulnerability is uniquely identified as CVE-2025-15022 since 12/22/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-0820) and CERT Bund (WID-SEC-2026-0003). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source Vaadin

Productinfo

Name

• vaadin
• vaadin-spreadsheet-flow

Version

• 7.7.0
• 7.7.1
• 7.7.2
• 7.7.3
• 7.7.4
• 7.7.5
• 7.7.6
• 7.7.7
• 7.7.8
• 7.7.9
• 7.7.10
• 7.7.11
• 7.7.12
• 7.7.13
• 7.7.14
• 7.7.15
• 7.7.16
• 7.7.17
• 7.7.18
• 7.7.19
• 7.7.20
• 7.7.21
• 7.7.22
• 7.7.23
• 7.7.24
• 7.7.25
• 7.7.26
• 7.7.27
• 7.7.28
• 7.7.29
• 7.7.30
• 7.7.31
• 7.7.32
• 7.7.33
• 7.7.34
• 7.7.35
• 7.7.36
• 7.7.37
• 7.7.38
• 7.7.39
• 7.7.40
• 7.7.41
• 7.7.42
• 7.7.43
• 7.7.44
• 7.7.45
• 7.7.46
• 7.7.47
• 7.7.48
• 7.7.49
• 8.29.0
• 8.29.1
• 23.6.0
• 23.6.1
• 23.6.2
• 23.6.3
• 23.6.4
• 23.6.5
• 24.8.0
• 24.8.1
• 24.8.2
• 24.8.3
• 24.8.4
• 24.8.5
• 24.8.6
• 24.8.7
• 24.8.8
• 24.8.9
• 24.8.10
• 24.8.11
• 24.8.12
• 24.8.13
• 24.9.0
• 24.9.1
• 24.9.2
• 24.9.3
• 24.9.4
• 24.9.5
• 24.9.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion