CVE-2026-59286: Spring for GraphQL loads Untrusted Resources in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Affected Software
Event History
Frequently Asked Questions
Who is exposed to code execution through this issue?
Users whose browsers load the bundled GraphiQL page are exposed, because the page loads JavaScript libraries from a public CDN without Subresource Integrity checks.
What would an attacker need to exploit this vulnerability?
An attacker would need to inject malicious code into the JavaScript libraries loaded from the public CDN. That code could then execute in the browser of a user loading the GraphiQL page.
Which Spring for GraphQL versions are affected?
Affected versions are 2.0.0 through 2.0.4, 1.4.0 through 1.4.6, 1.1.0 through 1.3.9, and 1.0.0 through 1.0.7.