CVE-2026-59286

Modified Modified - Updated After Analysis

JavaScript Code Injection in Spring for GraphQL GraphiQL

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59286

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_for_graphql	From 1.4.0 (inc) to 1.4.7 (exc)
vmware	spring_for_graphql	From 2.0.0 (inc) to 2.0.4.1 (exc)
vmware	spring_for_graphql	From 1.0.0 (inc) to 1.0.8 (exc)
vmware	spring_for_graphql	From 1.1.0 (inc) to 1.3.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring for GraphQL versions between 1.0.0-1.0.7, 1.1.0-1.3.9, 1.4.0-1.4.6, and 2.0.0-2.0.4. The GraphiQL page included in these versions loads JavaScript libraries from a public CDN without verifying their integrity. An attacker can replace these scripts with malicious versions, leading to arbitrary code execution in the browser when the GraphiQL page is accessed.

Detection Guidance

Check if the GraphiQL endpoint is enabled by inspecting application properties or logs for `spring.graphql.graphiql.enabled=true`. Verify if JavaScript libraries are loaded from public CDNs without Subresource Integrity checks in the GraphiQL page source.

Impact Analysis

If exploited, an attacker could execute arbitrary code in the browser of any user accessing the GraphiQL page. This could allow the attacker to steal non-HttpOnly cookies, perform authenticated same-origin requests, and execute GraphQL operations on behalf of the user. The impact depends on whether the GraphiQL endpoint is exposed and if the CDN or network path is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data via browser-based attacks, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited in healthcare environments.

Mitigation Strategies

Upgrade to fixed versions: 2.0.5 (OSS), 2.0.4.1 (Enterprise), 1.4.7 (Enterprise), 1.3.10 (Enterprise), or 1.0.8 (Enterprise). Alternatively, disable the GraphiQL endpoint by setting `spring.graphql.graphiql.enabled=false` or use a self-hosted GraphiQL copy.

Hi! I’m here to help you understand CVE-2026-59286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70