@vaadin/component-base vulnerabilities

CVEs whose affected-version data names the @vaadin/component-base package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-91860Medium· 6.3

today

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes ont…

▾ Sunlitvaadin · com.vaadin:vaadinvia NVD