What’s Vulnerable › Vulnerabilities

CVE-2021-31411: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-05 · updated 2026-06-17
• Weakness: CWE-379

Description

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

Affected products

• vaadin flow: from 2.0.9 before 2.5.3; from 3.0.0 through 5.0.0; from 6.0.0 through 6.0.6 — fixed in 2.5.3
• Vaadin: from 14.0.3 before 14.5.3; from 15.0.0 before 19.0.5 — fixed in 14.5.3, 19.0.5

How to fix

Upgrade to a fixed version: vaadin flow 2.5.3; Vaadin 14.5.3, 19.0.5. Check the vendor advisory for mitigations.

References

• https://github.com/vaadin/flow/pull/10640
• https://vaadin.com/security/cve-2021-31411
• https://github.com/vaadin/flow/pull/10640
• https://vaadin.com/security/cve-2021-31411

Get alerted when CVE-2021-31411 or the next vulnerability affects your stack