{"answers":{"affected":"16 open source packages ship an affected version, including com.vaadin:vaadin, com.vaadin:vaadin-server and com.vaadin:vaadin-spreadsheet-flow.","exploited":"There is no known exploitation of CVE-2025-15022 in the wild and no public exploit code.","fix":"Upgrade com.vaadin:vaadin to a fixed version for your release line: 23.6.6, 24.8.14 or 24.9.7.","what":"CVE-2025-15022 is a medium-severity cross-site scripting vulnerability in vaadin framework, published on 5 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-15022 and fix it if it is affected.\n\nWhat it is: CVE-2025-15022 is a medium-severity cross-site scripting vulnerability in vaadin framework, published on 5 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2025-15022 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- com.vaadin:vaadin (Maven): affected from 23.1.0; fixed in 23.6.6\n- com.vaadin:vaadin (Maven): affected from 23.1.0; fixed in 23.6.6\n- com.vaadin:vaadin (Maven): affected from 24.0.0; fixed in 24.8.14\n- com.vaadin:vaadin (Maven): affected from 24.0.0; fixed in 24.8.14\n- com.vaadin:vaadin (Maven): affected from 24.9.0; fixed in 24.9.7\n- com.vaadin:vaadin (Maven): affected from 24.9.0; fixed in 24.9.7\n- com.vaadin:vaadin-server (Maven): affected from 7.0.0; fixed in 7.7.50\n- com.vaadin:vaadin-server (Maven): affected from 7.0.0; fixed in 7.7.50\n- com.vaadin:vaadin-server (Maven): affected from 8.0.0; fixed in 8.30.0\n- com.vaadin:vaadin-server (Maven): affected from 8.0.0; fixed in 8.30.0\n- com.vaadin:vaadin-spreadsheet-flow (Maven): affected from 23.1.0; fixed in 23.6.6\n- com.vaadin:vaadin-spreadsheet-flow (Maven): affected from 23.1.0; fixed in 23.6.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-15022/ (Markdown: https://insights.sbomify.com/CVE-2025-15022/index.md)","id":"CVE-2025-15022","markdown":"https://insights.sbomify.com/CVE-2025-15022/index.md","name":"CVE-2025-15022","record":{"aliases":["GHSA-7wwv-79xw-rvvg"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Vaadin UI framework","requires_auth":"low_privilege","summary":"Attackers can inject malicious scripts via unsanitized action captions in Vaadin, potentially executing code in user browsers.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Vaadin","cpe":[],"cvss":{"score":4.8,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber","version":"4.0"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input.\n\nIn Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.\n\nIn Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist.\n\nVaadin 14 is not affected as Spreadsheet component was not supported.\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 7.0.0 - 7.7.49\nVaadin 8.0.0 - 8.29.1\nVaadin 23.1.0 - 23.6.5\nVaadin 24.0.0 - 24.8.13\nVaadin 24.9.0 - 24.9.6\n\nMitigation\nUpgrade to 7.7.50\nUpgrade to 8.30.0\nUpgrade to 23.6.6\nUpgrade to 24.8.14 or 24.9.7\nUpgrade to 25.0.0 or newer\n\nArtifacts     Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server\n7.0.0 - 7.7.49\n≥7.7.50\ncom.vaadin:vaadin-server\n8.0.0 - 8.29.1\n≥8.30.0\ncom.vaadin:vaadin\n23.1.0 - 23.6.5\n≥23.6.6\ncom.vaadin:vaadin24.0.0 - 24.8.13\n≥24.8.14\ncom.vaadin:vaadin24.9.0 - 24.9.6\n≥24.9.7\ncom.vaadin:vaadin-spreadsheet-flow\n23.1.0 - 23.6.5\n≥23.6.6\ncom.vaadin:vaadin-spreadsheet-flow\n24.0.0 - 24.8.13\n≥24.8.14\ncom.vaadin:vaadin-spreadsheet-flow\n24.9.0 - 24.9.6\n≥24.9.7","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Cross-site scripting in Action caption","id":"CVE-2025-15022","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"xss","year":"2025"},"n_packages":16,"n_references":2,"next":{"headline":"Improper Access Control in Yordam Informatics' Library Automation System","id":"CVE-2025-15023"},"packages":[{"ecosystem":"Maven","fixed":["23.6.6"],"introduced":["23.1.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["23.6.6"],"introduced":["23.1.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":"pkg:maven/com.vaadin/vaadin","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.8.14"],"introduced":["24.0.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.8.14"],"introduced":["24.0.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":"pkg:maven/com.vaadin/vaadin","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.9.7"],"introduced":["24.9.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.9.7"],"introduced":["24.9.0"],"last_affected":[],"package":"com.vaadin:vaadin","purl":"pkg:maven/com.vaadin/vaadin","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["7.7.50"],"introduced":["7.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-server","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["7.7.50"],"introduced":["7.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-server","purl":"pkg:maven/com.vaadin/vaadin-server","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["8.30.0"],"introduced":["8.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-server","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["8.30.0"],"introduced":["8.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-server","purl":"pkg:maven/com.vaadin/vaadin-server","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["23.6.6"],"introduced":["23.1.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["23.6.6"],"introduced":["23.1.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.8.14"],"introduced":["24.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.8.14"],"introduced":["24.0.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow","source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.9.7"],"introduced":["24.9.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":null,"source":"GHSA-7wwv-79xw-rvvg"},{"ecosystem":"Maven","fixed":["24.9.7"],"introduced":["24.9.0"],"last_affected":[],"package":"com.vaadin:vaadin-spreadsheet-flow","purl":"pkg:maven/com.vaadin/vaadin-spreadsheet-flow","source":"GHSA-7wwv-79xw-rvvg"}],"prev":{"headline":"Gotham Block Extra Light \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","id":"CVE-2025-15021"},"products":["framework","vaadin","vaadin-spreadsheet-flow"],"published":"2026-01-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-01-05","vendors":["vaadin"]},"summary":"Attackers can inject malicious scripts via unsanitized action captions in Vaadin, potentially executing code in user browsers.","url":"https://insights.sbomify.com/CVE-2025-15022/"}