CVE-2026-59328
Received Received - Intake

Cross-Site Scripting in Spring Tools for Eclipse

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VMware

Description
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-59328
EUVD
EUVD-2026-50975

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vmware spring_tools_for_eclipse to 5.2.0 (exc)
vmware spring_tools_for_eclipse to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Spring Tools for Eclipse. It occurs because the embedded browser used to display dependency tooltips in the New Spring Starter Project wizard has JavaScript enabled. If a developer uses an untrusted Initializr endpoint, hovering over a dependency checkbox could execute arbitrary scripts within the IDE's UI.

Detection Guidance

Detecting this vulnerability involves checking the version of Spring Tools for Eclipse installed and verifying the configured Initializr endpoints. Ensure no untrusted endpoints are used in the New Spring Starter Project wizard. Inspect network traffic for outbound requests to suspicious Initializr URLs.

Impact Analysis

The impact is limited to UI spoofing and outbound network requests. An attacker could trick a developer into making unintended network connections or seeing fake UI elements, but full code execution is not possible.

Mitigation Strategies

Upgrade to Spring Tools for Eclipse version 5.3.0 or later. If upgrading is not immediately possible, configure only trusted Initializr service URLs and ensure network access to these endpoints is secured with HTTPS and trusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart