Executive brief
Spring Web Flow is a framework that handles complex web application workflows, including JavaScript-based remote calls. The JavaScript RemotingHandler component fails to properly validate the content type of error responses before rendering them as HTML in the browser. An attacker can craft an error response containing malicious JavaScript code that gets executed in the user's browser, potentially allowing session hijacking or credential theft.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in Spring Web Flow's JavaScript RemotingHandler component. The root cause is insufficient content-type validation: the handler renders all error responses as HTML without checking the Content-Type header, allowing attacker-controlled error messages to be executed as JavaScript in the user's browser. The attack requires network access, low privileges, and user interaction (the user must trigger a remote call that produces an error). The attacker can achieve arbitrary script execution in the victim's browser context, potentially leading to session hijacking or credential theft. Patches are available: version 4.0.1 for the 4.0.x line, 3.0.2 for 3.0.x, and no patch for the 2.5.x line (though 2.5.2+ likely contains a fix).
Affected products
- Spring Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1
Timeline
- 2026-06-11: disclosed: Published by GitHub Advisory Database and NVD
- 2026-08-18: advisory: GitHub reviewed and updated advisory
- 2026-06-11: patched: Patches released: 4.0.1, 3.0.2