CVE-2026-41845
Received Received - Intake
JavaScript Code Injection in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: VMware

Description
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-09
AI Q&A
2026-06-09
EPSS Evaluated
N/A
NVD
CVE-2026-41845
EUVD
EUVD-2026-35333
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
vmware spring_framework From 5.3.0 (inc) to 5.3.48 (inc)
vmware spring_framework From 6.1.0 (inc) to 6.1.27 (inc)
vmware spring_framework From 6.2.0 (inc) to 6.2.18 (inc)
vmware spring_framework From 7.0.0 (inc) to 7.0.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41845 is a cross-site scripting (XSS) vulnerability in the Spring Framework.

It occurs due to incorrect escaping in the JavaScriptUtils.javaScriptEscape() method, which can lead to JavaScript code injection in the browser.

This means that malicious JavaScript code could be injected and executed in the context of a user's browser.

Impact Analysis

This vulnerability can allow attackers to inject malicious JavaScript code into web pages viewed by users.

Such cross-site scripting (XSS) attacks can lead to theft of user data, session hijacking, or other malicious actions performed in the context of the affected website.

Users of affected Spring Framework versions may be at risk if they do not upgrade to the fixed versions.

Mitigation Strategies

The recommended mitigation for this vulnerability is to upgrade the Spring Framework to the fixed versions.

  • Upgrade to Spring Framework version 7.0.8 if you are using the 7.0.x branch.
  • Upgrade to Spring Framework version 6.2.19 if you are using the 6.2.x branch.
  • Upgrade to Spring Framework version 6.1.28 if you are using the 6.1.x branch.
  • Upgrade to Spring Framework version 5.3.49 if you are using the 5.3.x branch.

No additional mitigation steps are required beyond upgrading.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart