GHSA-8vfw-v2jv-9hwc
Reflected cross-site scripting in development mode handler in Vaadin
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Reflected cross-site scripting in development mode handler in Vaadin
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
- Record
GHSA-8vfw-v2jv-9hwc- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-172
- Updated
- 2026-11-02
OSV
Reflected cross-site scripting in development mode handler in Vaadin
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
- Record
GHSA-8vfw-v2jv-9hwc- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-172
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-serverMaven | 2.0.0 to 2.6.1 | 2.6.2 |
com.vaadin:flow-serverMaven | 3.0.0 to 6.0.9 | 6.0.10 |
com.vaadin:flow-serverMaven | 2.0.0 up to 2.6.2, plus listed versions 2.0.12.0.102.0.112.0.122.0.13 Show 45 moreShow less2.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.0.beta22.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0.alpha112.2.12.2.22.2.32.3.02.3.0.beta12.3.12.3.22.3.32.3.42.3.52.3.62.3.72.4.02.4.12.4.22.4.32.4.42.4.5 | 2.6.2 |
com.vaadin:flow-serverMaven | 3.0.0 up to 6.0.10, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 33 moreShow less3.0.63.0.73.1.03.1.13.1.23.1.33.1.53.1.63.1.74.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.85.0.05.0.15.0.25.0.35.0.46.0.06.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9 | 6.0.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8vfw-v2jv-9hwc is a low vulnerability (CVSS 2.5) in com.vaadin:flow-server, published June 28, 2021. No source lists public exploit code. Fixed in com.vaadin:flow-server 2.6.2.
References
Left out here: 11 versions. The JSON record has them.