~ / search / GHSA-3chg-m5w7-qfv5

GHSA-3chg-m5w7-qfv5

Spring Framework Cross-site Scripting via JavaScriptUtils

Source: GitHub Advisory Database (reviewed) High CVE-2026-41845

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-webmvc >= 7.0.0, < 7.0.8 7.0.8
Maven org.springframework:spring-webmvc >= 6.2.0, < 6.2.19 6.2.19
Maven org.springframework:spring-webmvc >= 6.1.0, <= 6.1.21 no fix listed
Maven org.springframework:spring-webmvc <= 5.3.39 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

References

External links from the advisory. They lead to third-party sites.