{"action":"Upgrade com.vaadin:vaadin to 23.6.6 (23.6.x), 24.8.14 (24.8.x) or 24.9.7 (24.9.x) or later.","affected":[{"fixed":"23.6.6","introduced":"23.1.0"},{"fixed":"24.8.14","introduced":"24.0.0"},{"fixed":"24.9.7","introduced":"24.9.0"}],"component":"com.vaadin:vaadin","cve_ids":["CVE-2025-15022"],"ecosystem":"Maven","epss":0.00332,"exploited":false,"fixed_versions":["23.6.6","24.8.14","24.9.7"],"ghsa_id":"GHSA-7wwv-79xw-rvvg","id":"tcs_01M5N8KCBS5CECJXPGADAG30P1","modified_at":"2026-09-10T03:50:33.190776453Z","published_at":"2026-01-05T09:30:19Z","references":["https://osv.dev/vulnerability/GHSA-7wwv-79xw-rvvg","https://nvd.nist.gov/vuln/detail/CVE-2025-15022","https://github.com/vaadin/flow-components/pull/8285","https://github.com/vaadin/flow-components/commit/71046aa3dd08be0907bd03140c33131b94f6e99c","https://github.com/vaadin/flow-components","https://vaadin.com/security/cve-2025-15022"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-7wwv-79xw-rvvg#Maven/com.vaadin:vaadin","url":"https://osv.dev/vulnerability/GHSA-7wwv-79xw-rvvg"}],"summary":"Vaadin vulnerable to Cross-site Scripting"}