CVE-2026-41845

Analyzed Analyzed - Analysis Complete

JavaScript Code Injection in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-27

Assigner: VMware

Description

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-27

Generated

2026-06-29

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-41845

EUVD

EUVD-2026-35333

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 5.3.0 (inc) to 5.3.49 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.28 (exc)
vmware	spring_framework	From 6.2.0 (inc) to 6.2.19 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-41845 is a cross-site scripting (XSS) vulnerability in the Spring Framework.

It occurs due to incorrect escaping in the JavaScriptUtils.javaScriptEscape() method, which can lead to JavaScript code injection in the browser.

This means that malicious JavaScript code could be injected and executed in the context of a user's browser.

Impact Analysis

This vulnerability can allow attackers to inject malicious JavaScript code into web pages viewed by users.

Such cross-site scripting (XSS) attacks can lead to theft of user data, session hijacking, or other malicious actions performed in the context of the affected website.

Users of affected Spring Framework versions may be at risk if they do not upgrade to the fixed versions.

Mitigation Strategies

The recommended mitigation for this vulnerability is to upgrade the Spring Framework to the fixed versions.

Upgrade to Spring Framework version 7.0.8 if you are using the 7.0.x branch.
Upgrade to Spring Framework version 6.2.19 if you are using the 6.2.x branch.
Upgrade to Spring Framework version 6.1.28 if you are using the 6.1.x branch.
Upgrade to Spring Framework version 5.3.49 if you are using the 5.3.x branch.

No additional mitigation steps are required beyond upgrading.

Compliance Impact

The provided information does not specify how the CVE-2026-41845 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-41845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70