Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/com.vaadin/flow-maven-plugin@25.1.0
Typemaven
Namespacecom.vaadin
Nameflow-maven-plugin
Version25.1.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version25.1.5
Latest_non_vulnerable_version25.1.5
Affected_by_vulnerabilities
0
url VCID-eu8v-6g1h-7yhp
vulnerability_id VCID-eu8v-6g1h-7yhp
summary 
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts.


Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version
Vaadin 23.0.0 - 23.6.9
Vaadin 24.0.0 - 24.9.16
Vaadin 24.10.0 - 24.10.3
Vaadin 25.0.0 - 25.0.10
Vaadin 25.1.0 - 25.1.4

Mitigation
Upgrade to 23.6.10
Upgrade to 24.9.17 or newer
Upgrade to 24.10.4 or newer
Upgrade to 25.0.11 or newer
Upgrade to 25.1.5 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version.

ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10≥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4≥25.1.5com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17≥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3≥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11≥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4≥25.1.5
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-7860
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.038
published_at 2026-06-12T12:55:00Z
1
value 0.00016
scoring_system epss
scoring_elements 0.0378
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-7860
1
reference_url https://github.com/vaadin/flow
reference_id
reference_type
scores
0
value 1.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow
2
reference_url https://github.com/vaadin/flow/pull/24219
reference_id 24219
reference_type
scores
0
value 1.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-19T13:42:28Z/
url https://github.com/vaadin/flow/pull/24219
3
reference_url https://vaadin.com/security/cve-2026-7860
reference_id cve-2026-7860
reference_type
scores
0
value 1.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-19T13:42:28Z/
url https://vaadin.com/security/cve-2026-7860
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-7860
reference_id CVE-2026-7860
reference_type
scores
0
value 1.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:N/R:A/V:C/RE:L/U:Green
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-7860
5
reference_url https://github.com/advisories/GHSA-j8mx-j73w-9mxw
reference_id GHSA-j8mx-j73w-9mxw
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j8mx-j73w-9mxw
fixed_packages
0
url pkg:maven/com.vaadin/flow-maven-plugin@25.1.5
purl pkg:maven/com.vaadin/flow-maven-plugin@25.1.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-maven-plugin@25.1.5
aliases CVE-2026-7860, GHSA-j8mx-j73w-9mxw
risk_score 1.4
exploitability 0.5
weighted_severity 2.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-eu8v-6g1h-7yhp
Fixing_vulnerabilities
Risk_score1.4
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-maven-plugin@25.1.0