Cross-Site Scripting and Object Prototype Vulnerabilities in Vaadin Charts by Highsoft

CVE-2026-107588

What is CVE-2026-107588?

Vaadin Charts, using Highcharts version 9.2.2, is susceptible to security vulnerabilities including cross-site scripting (XSS) and object prototype pollution. This occurs when an attacker can inject malicious data into chart configurations that the application does not properly sanitize. Vulnerabilities can be exploited through certain chart options where user-controlled data is improperly handled, leading to potential XSS attacks. Users are urged to upgrade to the latest patched versions of Vaadin Charts to mitigate these risks.

References