CVE-2026-41846: VMware Spring Framework XSS in JSP form tags

CVE-2026-41846 · Severity: medium · CVSS 5.9 · Published 2026-06-09

Spring Framework is a widely used tool for building Java-based web applications. A security flaw in its web component allows attackers to inject malicious scripts into web pages if the application uses certain form tags with user-provided styling information. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.

Technologies: org.springframework:spring-webmvc (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41846 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41846 being exploited in the wild.
How severe is CVE-2026-41846?
Medium severity, with a CVSS score of 5.9, published 9 June 2026.
Which products and versions are affected?
org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48, 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.
Is there a fix for CVE-2026-41846?
Yes. org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41846 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41846?
Check whether you run org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later
    # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Spring MVC's JSP form tag library. The root cause is the improper neutralization of input within the 'cssClass', 'cssErrorClass', and 'cssStyle' attributes of JSP form tags. An attacker can exploit this by providing malicious HTML or JavaScript code that is subsequently rendered by the server without adequate escaping. Exploitation requires the application to accept user-controlled strings for these specific attributes and typically involves user interaction (UI:R). Patches are available in versions 7.0.8 and 6.2.19, with updates also provided for the 6.1.x and 5.3.x branches.

Affected products

  • VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

Identifiers

  • CVE-2026-41846
  • GHSA-957g-f97v-vppc

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-30: patched: Updated advisory with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.