CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Tools for Eclipseto a version that resolves this vulnerability.Fixed in 5.2.0 - Compensating control
Avoid using untrusted or compromised Initializr endpoints when creating Spring Boot starter projects in the New Spring Starter Project wizard (ensure Initializr endpoint is trusted).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59328?
CVE-2026-59328 has a medium severity score of 4.2.
How do I fix CVE-2026-59328?
To mitigate CVE-2026-59328, avoid using untrusted and compromised Initializr endpoints in the Spring Boot starter wizard.
What type of vulnerability is CVE-2026-59328?
CVE-2026-59328 is classified as a Cross-Site Scripting (XSS) vulnerability.
Which product is affected by CVE-2026-59328?
CVE-2026-59328 affects Pivotal Software Spring Tools for Eclipse.
What could be the impact of CVE-2026-59328?
The impact of CVE-2026-59328 could allow arbitrary script execution within the embedded browser of the tool.