Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-47858

live information startup mode is vulnerable for remote code execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Tools for Eclipse

Default version status: unaffected

  • 0 to ≤ 5.2.0affected

Spring Spring Tools for VSCode / Cursor / Theia

Default version status: unaffected

  • 0 to ≤ 2.2.0affected

References