CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-24 · updated 2026-06-17
Weakness: CWE-172

Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Affected products

Vaadin flow-server: from 2.0.0 through 2.6.1; from 3.0.0 through 5.0.0; from 6.0.0 through 6.0.9
Vaadin: from 14.0.0 through 14.6.1; from 15.0.0 through 18.0.0; from 19.0.0 through 19.0.8

References

https://github.com/vaadin/flow/pull/11099
https://vaadin.com/security/cve-2021-33604
https://github.com/vaadin/flow/pull/11099
https://vaadin.com/security/cve-2021-33604

Get alerted when CVE-2021-33604 or the next vulnerability affects your stack