CVE-2026-40986: VMware Spring Web Flow XSS in JavaScript RemotingHandler

CVE-2026-40986 · Severity: medium · CVSS 4.8 · Published 2026-06-11

Spring Web Flow is a framework that handles complex web application workflows, including JavaScript-based remote calls. The JavaScript RemotingHandler component fails to properly validate the content type of error responses before rendering them as HTML in the browser. An attacker can craft an error response containing malicious JavaScript code that gets executed in the user's browser, potentially allowing session hijacking or credential theft.

Technologies: org.springframework.webflow:spring-webflow (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40986 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40986 being exploited in the wild.
How severe is CVE-2026-40986?
Medium severity, with a CVSS score of 4.8, published 11 June 2026.
Which products and versions are affected?
org.springframework.webflow:spring-webflow (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1; VMware Spring Web Flow 4.0.0, 3.0.0 - 3.0.1, 2.5.0 - 2.5.1.
Is there a fix for CVE-2026-40986?
Yes. org.springframework.webflow:spring-webflow (Maven): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40986 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40986?
Check whether you run org.springframework.webflow:spring-webflow (Maven) or VMware Spring Web Flow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.webflow:spring-webflow (Maven): upgrade to 4.0.1 or later
    # set org.springframework.webflow:spring-webflow to 4.0.1 in your pom.xml or build.gradle

Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in Spring Web Flow's JavaScript RemotingHandler component. The root cause is insufficient content-type validation: the handler renders all error responses as HTML without checking the Content-Type header, allowing attacker-controlled error messages to be executed as JavaScript in the user's browser. The attack requires network access, low privileges, and user interaction (the user must trigger a remote call that produces an error). The attacker can achieve arbitrary script execution in the victim's browser context, potentially leading to session hijacking or credential theft. Patches are available: version 4.0.1 for the 4.0.x line, 3.0.2 for 3.0.x, and no patch for the 2.5.x line (though 2.5.2+ likely contains a fix).

Affected products

  • Spring Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1

Identifiers

  • CVE-2026-40986
  • GHSA-hw5c-xm3c-v96w

Timeline

  • 2026-06-11: disclosed: Published by GitHub Advisory Database and NVD
  • 2026-08-18: advisory: GitHub reviewed and updated advisory
  • 2026-06-11: patched: Patches released: 4.0.1, 3.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.