CVE-2025-15022: Vaadin Cross-site Scripting Vulnerability in Action Captions
Summary
CVE-2025-15022: Vaadin vulnerable to Cross-site Scripting. Affects com.vaadin:vaadin-server across 2 version ranges.
>= 7.0.0, < 7.7.50
>= 8.0.0, < 8.30.0
Fixed in 7.7.50 or 8.30.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is a popular open-source framework for building web applications in Java. It allows developers to create rich user interfaces with a focus on simplicity and productivity. The framework includes various components, including the Action class, which is utilized for handling user interactions. However, certain versions of Vaadin have been found to be vulnerable to Cross-site Scripting (XSS) attacks due to improper handling of HTML content in action captions.
Vulnerability Detail
The vulnerability arises from the Action class in Vaadin Framework versions 7 and 8, where action captions accept HTML by default without proper sanitization. This oversight can lead to XSS attacks if caption content is derived from user input, allowing attackers to inject malicious scripts. In Vaadin 23 and newer, while the Action class is limited to the Spreadsheet component, the issue persists unless the HTML content is sanitized. Vaadin 14 is not affected as it does not support the Spreadsheet component.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.7.507.7.50 -
>= 8.0.0, < 8.30.08.30.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the risk by ensuring that any user-generated content used in action captions is properly sanitized before being displayed. This can be done using libraries like Jsoup to clean the HTML content.
Conclusion
The vulnerability identified as CVE-2025-15022 in the Vaadin framework poses a significant risk due to improper handling of HTML in action captions. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. For those unable to upgrade immediately, sanitizing user input is crucial to prevent potential XSS attacks.
See every vulnerability recorded for com.vaadin:vaadin-server →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session integrity.
Vaadin Framework versions 7.0.0 to 7.7.49, 8.0.0 to 8.29.1, and 23.1.0 to 23.6.5 are affected. Vaadin 14 is not affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
If an immediate upgrade is not possible, ensure that any user-generated content in action captions is sanitized to prevent XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-server.
