Detections
Analytics

SCA: security update for com.vaadin:vaadin, com.vaadin:vaadin-server, com.vaadin:vaadin-spreadsheet-flow (GHSA-7wwv-79xw-rvvg)

medium Tenable Self-Hosted Container Security Plugin ID 436586

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site
 Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action
 class is a general-purpose class that may be used by multiple components. The fixed versions sanitize
 captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility.
 In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions
 sanitize HTML using Jsoup with a relaxed safelist. Vaadin 14 is not affected as Spreadsheet component was
 not supported. Users of affected versions should apply the following mitigation or upgrade. Releases that
 have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 -
 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6 Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0
 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer Artifacts Maven
 coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50
 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6
 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-
 spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14
 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7 (CVE-2025-15022)

See Also

https://github.com/advisories/GHSA-7wwv-79xw-rvvg

Plugin Details

Severity: Medium

ID: 436586

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2025-15022

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/5/2026

Vulnerability Publication Date: 1/5/2026

Reference Information

CVE: CVE-2025-15022

cwe: CWE-79