CVE-2019-25027: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Summary
CVE-2019-25027: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13. Affects com.vaadin:flow-server across 2 version ranges.
>= 1.0.0, < 1.0.11
>= 1.1.0, < 1.4.3
Fixed in 1.0.11 or 1.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. The com.vaadin:flow-server package is a part of Vaadin and provides server-side components and functionality for the framework. This vulnerability affects versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13) and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) of the com.vaadin:flow-server package.
Vulnerability Detail
The vulnerability in the default RouteNotFoundError view of Vaadin allows an attacker to execute malicious JavaScript by exploiting a reflected cross-site scripting (XSS) vulnerability. This occurs due to missing output sanitization in the affected versions. An attacker can craft a malicious URL that, when visited by a user, triggers the execution of the injected JavaScript code. This can lead to various consequences, such as unauthorized access to user data, session hijacking, or defacement of the application.
How To Fix
Latest published version: 25.3.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.111.0.11 -
>= 1.1.0, < 1.4.31.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to manually sanitize the output in the RouteNotFoundError view. This can be done by applying appropriate output encoding or escaping techniques to any user-generated content that is displayed in the view.
Conclusion
The reflected cross-site scripting vulnerability in the default RouteNotFoundError view of Vaadin can be mitigated by upgrading to the fixed versions of the com.vaadin:flow-server package. If immediate upgrade is not possible, manual output sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:flow-server →
FAQ
The vulnerability allows an attacker to execute malicious JavaScript, potentially leading to unauthorized access to user data, session hijacking, or defacement of the application.
No, only versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13) and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) of the com.vaadin:flow-server package are affected.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
You can find more information about this vulnerability, including the CVE identifier (CVE-2019-25027), on the Vaadin security advisory page: https://vaadin.com/security/cve-2019-25027
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:flow-server.
