CVE-2026-59281: Spring Framework Cross-site Scripting via EscapedErrors
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.2.25.RELEASE - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.3.49 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.0.30 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.1.28 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.2.19 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 7.0.8
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Spring MVC and WebFlux applications are affected when they obtain a data-binding Errors instance with HTML escaping enabled and render field errors through the no-argument Errors.getFieldErrors() or Errors.getFieldError() methods.
What must an attacker be able to do to exploit it?
An attacker must be able to supply input that reaches data binding and is subsequently included in field-error rendering through the affected no-argument accessors. Successful exploitation can inject arbitrary HTML or JavaScript into the rendered response, creating a reflected XSS risk.
Which Spring Framework versions are affected?
Affected releases are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.