CVE-2026-41845: Spring Framework Cross-site Scripting via JavaScriptUtils

Synopsis

Cross-site scripting (XSS) in Spring Framework is caused by incorrect character escaping inside JavaScriptUtils.javaScriptEscape(). The vulnerability is reachable over the network without any authentication, but requires a victim to interact with a crafted link or page before the malicious script executes in their browser. Successful exploitation lets an attacker read sensitive data from the victim's browser session and perform limited content modification in the context of the affected origin. Patched-image rebuilds at versions 5.3.49, 6.1.28, 6.2.19, and 7.0.8 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected web application over the network; the service must be exposed via HTTP or HTTPS to be exploitable.

• AuthenticationNot required

  No account or credential is needed; the attack can be initiated by any anonymous party who can send a request to the application.

• Victim interactionRequired

  A user must follow a crafted link or visit a page that triggers the vulnerable JavaScriptUtils.javaScriptEscape() output, making this a reflected social-engineering vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental factors.

Blast Radius

• Reads stored session tokens, cookies, or credentials accessible to the victim's browser origin.
• Reads page content and data rendered in the victim's current session, including any sensitive fields displayed in the UI.
• Injects and executes arbitrary JavaScript in the victim's browser, enabling actions on their behalf within the affected application.