The Vaadin Rich Text Editor exports a video embed without escaping its value and then parses the resulting HTML into live DOM, so a crafted embed runs script in the browser of anyone who opens the page. Only content persisted through asDelta() is affected: the default HTML value is sanitized on the server and is safe. This vulnerability has been addressed in the latest supported versions of Vaadin. Users are advised to upgrade.
Are you affected?
- Affected: applications that persist and replay Rich Text Editor content through asDelta(), on Vaadin 25.0 through 25.3, where an attacker can edit content that other users read.
- Not affected: applications that use the default HTML value through setValue and getValue, which is sanitized on the server; applications on Vaadin 24 or older, which use Quill 1; and applications already on the fixed versions below.
- What to do: update to the fixed version for your Vaadin line, in the table below. No code changes are needed.
Description
The editor bundles Quill 2.0.3, whose video blot writes its value into a link without escaping it. A value crafted to close the href attribute early carries arbitrary markup into the exported HTML, and the component then parses that HTML into a live element, so the markup is executed rather than merely stored.
An attacker who can edit content that other users read pastes a video embed carrying the payload. The editor's paste handling converts it, the delta is saved, and the script runs for any user who later opens the page, including when the editor is read only. The victim does nothing beyond viewing.
This is the Vaadin specific manifestation of CVE-2025-15056 in Quill. Quill 2.0.3 is bundled at a fixed version, so no application can remediate by upgrading Quill itself, and there is no Quill release carrying the fix. The fix is in Vaadin code.
Fixed versions
Update to the version listed for your Vaadin line:
| Vaadin version |
Maintenance status |
Update to |
How to get it |
| 25.3 |
Free maintenance |
25.3.5 |
Free |
| 25.2 |
Free maintenance |
25.2.13 |
Free |
| 25.1 |
End of life |
25.2.13 or newer |
Free, after moving to 25.2 |
| 25.0 |
End of life |
25.2.13 or newer |
Free, after moving to 25.2 |
Vaadin 24 and older are not affected. The 25.0 and 25.1 lines received no fix of their own and will not get one.
Can't upgrade right away?
Persist the editor content through the default HTML value, with setValue and getValue, rather than through asDelta(). An application that must use asDelta() should strip video inserts from the delta before storing or replaying it.
Artifacts
| Maven coordinates |
Vulnerable version |
Fixed version |
| com.vaadin:vaadin |
25.0.0 - 25.0.13 |
≥25.2.13 |
| com.vaadin:vaadin |
25.1.0 - 25.1.13 |
≥25.2.13 |
| com.vaadin:vaadin |
25.2.0 - 25.2.12 |
≥25.2.13 |
| com.vaadin:vaadin |
25.3.0 - 25.3.4 |
≥25.3.5 |
| com.vaadin:vaadin-core |
25.0.0 - 25.0.13 |
≥25.2.13 |
| com.vaadin:vaadin-core |
25.1.0 - 25.1.13 |
≥25.2.13 |
| com.vaadin:vaadin-core |
25.2.0 - 25.2.12 |
≥25.2.13 |
| com.vaadin:vaadin-core |
25.3.0 - 25.3.4 |
≥25.3.5 |
| com.vaadin:vaadin-rich-text-editor-flow |
25.0.0 - 25.0.13 |
≥25.2.13 |
| com.vaadin:vaadin-rich-text-editor-flow |
25.1.0 - 25.1.13 |
≥25.2.13 |
| com.vaadin:vaadin-rich-text-editor-flow |
25.2.0 - 25.2.12 |
≥25.2.13 |
| com.vaadin:vaadin-rich-text-editor-flow |
25.3.0 - 25.3.4 |
≥25.3.5 |
| @vaadin/rich-text-editor |
25.0.0 - 25.0.13 |
≥25.2.17 |
| @vaadin/rich-text-editor |
25.1.0 - 25.1.14 |
≥25.2.17 |
| @vaadin/rich-text-editor |
25.2.0 - 25.2.16 |
≥25.2.17 |
| @vaadin/rich-text-editor |
25.3.0 - 25.3.4 |
≥25.3.5 |
The vulnerable code is in the npm package the component resolves, @vaadin/rich-text-editor, vulnerable in 25.0.0 to 25.3.4 and fixed in 25.2.17 and 25.3.5. Those numbers are not the Vaadin version numbers: Vaadin 25.2.13 resolves @vaadin/rich-text-editor 25.2.17.
Credits
Found internally at Vaadin.
References