As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.
Vaadin 6.8.8 fixes a security issue discovered during an internal review.Allowing unfiltered user input as the key in a map used for communication in a Vaadin UI component may enable a cross-site scripting (XSS) attack on a Vaadin application. Specifically, in certain cases it is possible to use a specially-crafted debug ID to inject arbitrary Javascript to be executed in an end user's browser. This requires specific actions both from the application developer and from the end user.
