A prototype pollution flaw in the deep merge helpers of Vaadin Charts and Vaadin Component Base allows an attacker to merge an object not controlled by the application into a chart configuration or the i18n property of a component. This operation writes arbitrary properties onto Object.prototype, making them visible and accessible to every object in the running process. Such global property injection can alter the behavior of heavily used libraries, break assumptions about object behavior, and potentially enable arbitrary code execution if the application later consults the polluted prototype for logic such as configuration, routing, or permissions.

Affected products include the Vaadin library core and component modules for Java-based Vaadin 23, 24, and 25, and the Vaadin Charts and Component Base npm modules for the same version ranges. Specifically, any release of com.vaadin:vaadin, com.vaadin:vaadin-core, or com.vaadin:vaadin-charts-flow from 23.0.0 through 25.2.6 is vulnerable, as are @vaadin/charts and @vaadin/component-base from 23.0.0 through 25.2.8. Upstream versions 10‑13 and 15‑22 are no longer supported and are included for completeness.

The CVSS score of 6.3 indicates a moderate severity. No EPSS value is available, so the likelihood of exploitation is uncertain but the ability to inject prototype properties is relatively straightforward if an attacker can place arbitrary data into a chart or i18n payload, such as through user input or third‑party data feeds. The vulnerability is not yet catalogued in CISA’s KEV. The attack vector is inferred to be remote, originating from untrusted data that is merged into a chart configuration or component property.