← Back

CVE-2026-59286

nvd nist
Published: Aug 27, 2026Modified: Sep 2, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Affected (4)

Vmware
1 product
Spring For Graphql
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring For Graphql
From 1.0.0 to 1.0.8
Spring For Graphql
From 1.1.0 to 1.3.10
Spring For Graphql
From 1.4.0 to 1.4.7
Spring For Graphql
From 2.0.0 to 2.0.4.1

Related CWEs

CWE-494
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.