Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Framework

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.8affected
  • 6.2.0 to ≤ 6.2.19affected
  • 6.1.0 to ≤ 6.1.28affected
  • 6.0.0 to ≤ 6.0.30affected
  • 5.3.0 to ≤ 5.3.49affected
  • 0 to ≤ 5.2.25.RELEASEaffected

References