JavaScript Injection Vulnerability in Vaadin Rich Text Editor
CVE-2026-120350

5.1MEDIUM

Key Information:

Vendor

Vaadin

Status
Vaadin
Vaadin-core
Vaadin-rich-text-editor-flow
Rich-text-editor
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120350?

The Vaadin Rich Text Editor has a vulnerability that permits a video embed to be exported without proper value escaping, allowing an attacker to break out of the href attribute and execute malicious scripts in the viewer's browser. This occurs when a user with editing capabilities pastes a crafted video embed, which is stored and later rendered for all users visiting the affected page, even in read-only mode. Notably, while content persisted through asDelta() is impacted, the default HTML value is sanitized server-side, preventing iframe embeds from surviving. Users are urged to upgrade to version 25.2.13 or newer for mitigation.

Affected Version(s)

rich-text-editor 25.0.0 <= 25.0.13

rich-text-editor 25.1.0 <= 25.1.14

rich-text-editor 25.2.0 < 25.2.17

References

https://vaadin.com/security/cve-2026-120350
https://github.com/vaadin/web-components/pull/13272
https://github.com/advisories/GHSA-v3m3-f69x-jf25

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.