Junglewise Threat Intelligence

CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils

CVE-2026-41845 · Severity: high · CVSS 7.1 · Published 2026-06-09

Technologies: VMware Spring Framework. Vendors: VMware, Spring.

Executive brief

Spring Framework is a widely used software development framework for Java applications. A security flaw in its JavaScript utility component could allow an attacker to inject malicious scripts into a user's web browser. If exploited, this could lead to unauthorized actions being performed on behalf of users, theft of sensitive session information, or the defacement of web pages.

Technical details

A cross-site scripting (XSS) vulnerability exists in the Spring Framework due to improper neutralization of input in the JavaScriptUtils.javaScriptEscape() method. The root cause is incorrect escaping logic within this utility, which fails to properly sanitize user-controllable input before it is rendered in a web page. An unauthenticated remote attacker can exploit this by sending a specially crafted request that, when processed by an application using this utility, executes arbitrary JavaScript in the context of the victim's browser. This vulnerability affects multiple major versions of the Spring Framework, and patches have been released in versions 7.0.8 and 6.2.19.

Affected products

  • Spring Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48

Timeline

  • 2026-06-09: advisory: Initial disclosure and NVD publication
  • 2026-07-30: advisory: GitHub Advisory updated with patched version details

References

Related threats