CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils

CVE-2026-41845 · Severity: high · CVSS 7.1 · Published 2026-06-09

Spring Framework is a widely used software development framework for Java applications. A security flaw in its JavaScript utility component could allow an attacker to inject malicious scripts into a user's web browser. If exploited, this could lead to unauthorized actions being performed on behalf of users, theft of sensitive session information, or the defacement of web pages.

Technologies: org.springframework:spring-webmvc (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41845 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41845 being exploited in the wild.
How severe is CVE-2026-41845?
High severity, with a CVSS score of 7.1, published 9 June 2026.
Which products and versions are affected?
org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Is there a fix for CVE-2026-41845?
Yes. org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41845 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41845?
Check whether you run org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later
    # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle

Technical details

A cross-site scripting (XSS) vulnerability exists in the Spring Framework due to improper neutralization of input in the JavaScriptUtils.javaScriptEscape() method. The root cause is incorrect escaping logic within this utility, which fails to properly sanitize user-controllable input before it is rendered in a web page. An unauthenticated remote attacker can exploit this by sending a specially crafted request that, when processed by an application using this utility, executes arbitrary JavaScript in the context of the victim's browser. This vulnerability affects multiple major versions of the Spring Framework, and patches have been released in versions 7.0.8 and 6.2.19.

Affected products

  • Spring Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48

Identifiers

  • CVE-2026-41845
  • GHSA-3chg-m5w7-qfv5

Timeline

  • 2026-06-09: advisory: Initial disclosure and NVD publication
  • 2026-07-30: advisory: GitHub Advisory updated with patched version details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.