Executive brief
Spring Framework's data-binding error handling fails to properly escape HTML when rendering field error messages through certain accessor methods. Attackers can inject malicious JavaScript code into form validation error displays, potentially stealing user session tokens or performing unauthorized actions in the context of an authenticated user's browser.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in Spring MVC and WebFlux applications that use the Errors interface with HTML escaping enabled. The vulnerability exists in the no-argument getFieldErrors() and getFieldError() accessor methods, which fail to apply HTML escaping to field error messages before rendering. An attacker can craft malicious input containing HTML/JavaScript payloads in form fields; when validation fails and error messages are rendered to the page, the unescaped payload executes in the victim's browser. The vulnerability affects Spring Framework 5.2.25.RELEASE and earlier, 5.3.0–5.3.49, 6.0.0–6.0.30, 6.1.0–6.1.28, 6.2.0–6.2.19, and 7.0.0–7.0.8. Patches have been released for affected versions.
Affected products
- Spring Spring Framework 5.2.25.RELEASE and earlier, 5.3.0–5.3.49, 6.0.0–6.0.30, 6.1.0–6.1.28, 6.2.0–6.2.19, 7.0.0–7.0.8
Timeline
- 2026-08-27: disclosed