CVE-2026-59281

Analyzed Analyzed - Analysis Complete

Reflected XSS in Spring Framework via Errors.getFieldErrors()

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59281

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	to 5.2.26 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring MVC and WebFlux applications that use a data-binding Errors instance with HTML escaping enabled. When field errors are rendered using Errors.getFieldErrors() or Errors.getFieldError(), it allows arbitrary HTML or JavaScript code injection, potentially leading to a reflected cross-site scripting (XSS) attack.

Detection Guidance

To detect this vulnerability, inspect Spring MVC or WebFlux applications using affected versions (5.2.25.RELEASE and earlier up to 7.0.8). Check if Errors.getFieldErrors() or Errors.getFieldError() methods are used to render field errors without proper HTML escaping. Review application logs for reflected XSS attempts or unusual JavaScript execution.

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages viewed by users. This could lead to session hijacking, data theft, or unauthorized actions on behalf of users. The impact depends on the application's context and user privileges.

Compliance Impact

This XSS vulnerability could compromise user data confidentiality, violating GDPR's data protection requirements. For HIPAA, it may risk unauthorized access to protected health information, potentially leading to compliance breaches and penalties.

Mitigation Strategies

Upgrade to the latest fixed versions of Spring Framework: 5.3.50, 6.0.31, 6.1.29, 6.2.20, or 7.0.9 depending on your release line. Enterprise users can use patches for versions 5.2.26, 6.0.31, 6.1.29, 6.2.20, and 7.0.8.1.

Hi! I’m here to help you understand CVE-2026-59281. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70