# CVE-2026-41846: VMware Spring Framework XSS in JSP form tags

Source: https://junglewise.ai/threats/cve-2026-41846-vmware-spring-framework-xss-in-jsp-form-tags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41846 · Severity: medium · CVSS 5.9 · Published 2026-06-09

Spring Framework is a widely used tool for building Java-based web applications. A security flaw in its web component allows attackers to inject malicious scripts into web pages if the application uses certain form tags with user-provided styling information. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.

Technologies: [org.springframework:spring-webmvc (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41846 being exploited in the wild.

**How severe is CVE-2026-41846?** Medium severity, with a CVSS score of 5.9, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48, 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.

**Is there a fix for CVE-2026-41846?** Yes. org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41846 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41846?** Check whether you run org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Spring MVC's JSP form tag library. The root cause is the improper neutralization of input within the 'cssClass', 'cssErrorClass', and 'cssStyle' attributes of JSP form tags. An attacker can exploit this by providing malicious HTML or JavaScript code that is subsequently rendered by the server without adequate escaping. Exploitation requires the application to accept user-controlled strings for these specific attributes and typically involves user interaction (UI:R). Patches are available in versions 7.0.8 and 6.2.19, with updates also provided for the 6.1.x and 5.3.x branches.

## Affected products

- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

## Identifiers

- CVE-2026-41846
- GHSA-957g-f97v-vppc

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched: Updated advisory with patch information

## References

- [https://spring.io/security/cve-2026-41846](https://spring.io/security/cve-2026-41846)
- [https://github.com/spring-projects/spring-framework/commit/1829b42b9c45e780c268dd17863d9198d62154d3](https://github.com/spring-projects/spring-framework/commit/1829b42b9c45e780c268dd17863d9198d62154d3)
- [https://github.com/spring-projects/spring-framework/commit/e8f10244e3859e8bb5b6be3823c9bbea2c130573](https://github.com/spring-projects/spring-framework/commit/e8f10244e3859e8bb5b6be3823c9bbea2c130573)
- [https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19](https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19)
- [https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8](https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)
- [Spring Framework SSRF and RCE in XsltView](https://junglewise.ai/threats/cve-2026-47884-spring-framework-ssrf-and-rce-in-xsltview)