Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13GHSA-jqj4-r483-4gvr
MEDIUMGHSA-jqj4-r483-4gvr is a medium-severity (CVSS 6.1) vulnerability in com.vaadin:vaadin-bom. A fix is available for com.vaadin:vaadin-bom — see the affected versions and patch details below.
Real-World Exposure
com.vaadin:vaadin-bom☕com.vaadin:vaadin-bomReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.vaadin:vaadin-bom | ≥ 10.0.0&&< 10.0.14 | 10.0.14com.vaadin:vaadin-bom:10.0.14 |
| ☕Maven | com.vaadin:vaadin-bom | ≥ 11.0.0&&< 13.0.6 | 13.0.6com.vaadin:vaadin-bom:13.0.6 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.vaadin:vaadin-bom, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.vaadin:vaadin-bom to 10.0.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jqj4-r483-4gvr is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-jqj4-r483-4gvr in your dependencies?
Find it across Maven, including transitive dependencies.