CVE-2026-120350: Stored Cross-Site Scripting in the Vaadin Rich Text Editor via an Unescaped Video Embed
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode.
Only content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor's own innerHTML, which the browser escapes.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4
Mitigation No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vaadin Rich Text Editorto a version that resolves this vulnerability.Fixed in 25.2.13 - Upgrade
Upgrade
Vaadin Rich Text Editorto a version that resolves this vulnerability.Fixed in 25.3.5
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected Vaadin 25 releases are exposed only when Rich Text Editor content is persisted through asDelta() and later rendered. Vaadin 24 and older are not affected, and the default setValue/getValue HTML path is not affected because server-side sanitization removes iframe content.
What access does an attacker need to exploit it?
An attacker must be able to edit shared Rich Text Editor content and insert a crafted video embed. When another user opens the stored content, including in read-only mode, the payload can execute in that user's browser.
What should we do if we cannot patch the current release line?
For the 25.0 and 25.1 lines, there is no fixed release; upgrade to Vaadin 25.2.13 or newer. For 25.2, upgrade to 25.2.13, and for 25.3, upgrade to 25.3.5.
How can we determine whether stored content may be affected?
Review whether Rich Text Editor data is stored using asDelta() and whether users can add video embeds to shared content. Stored deltas containing attacker-controlled video embed values should be treated as potentially unsafe when rendered.