← Back

CVE-2026-59281

nvd nist
Published: Aug 27, 2026Modified: Sep 2, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected (6)

Vmware
1 product
Spring Framework
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Framework
Before 5.2.26
Spring Framework
From 5.3.0 to 5.3.50
Spring Framework
From 6.0.0 to 6.0.31
Spring Framework
From 6.1.0 to 6.1.29
Spring Framework
From 6.2.0 to 6.2.20
Spring Framework
From 7.0.0 to 7.0.8.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.