# CVE-2021-33604

## Summary

- **CVE ID:** CVE-2021-33604
- **Severity:** LOW
- **CVSS Score:** 2.5 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
- **CWE:** CWE-172
- **Published:** Jun 24, 2021
- **Last Modified:** Mar 13, 2026

## Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

## Affected Products

- Vaadin — Vaadin (14.0.0)
- Vaadin — Vaadin (unspecified)
- Vaadin — Vaadin (15.0.0)
- Vaadin — flow-server (2.0.0)
- Vaadin — flow-server (unspecified)
- Vaadin — flow-server (3.0.0)

## References

- [CNA](https://vaadin.com/security/cve-2021-33604)
- [CNA](https://github.com/vaadin/flow/pull/11099)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.05%
- **EPSS Percentile:** 16.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._