CVE-2021-31411: Vaadin Flow

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

Affected products

• Vaadin Flow: from 2.0.9, before 2.5.3 (fixed in 2.5.3); from 3.0.0, up to and including 5.0.0; from 6.0.0, up to and including 6.0.6
• Vaadin Vaadin: from 14.0.3, before 14.5.3 (fixed in 14.5.3); from 15.0.0, before 19.0.5 (fixed in 19.0.5)

Published 2021-05-05. Last modified 2026-06-17.