CVE-2021-31411

    Dashboard / Vulnerabilities / CVE-2021-31411

    CVE-2021-31411

    Published: 5 May 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

    References: https://vaadin.com/security/cve-2021-31411, https://github.com/vaadin/flow/pull/10640

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 058a0e568a95bc163a7bb35a56c0ea4b56fe9e21
    Fixed -995027d29ee538e7f707b2454686be75f02977ef

    Affected versions

    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0.rc1
    6.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-31411 | CVE-DB