CVE-2026-41845: Spring Framework XSS Vulnerability

CVE-2026-41845 Overview

CVE-2026-41845 is a cross-site scripting (XSS) vulnerability in the Spring Framework. The flaw stems from incorrect escaping in the JavaScriptUtils.javaScriptEscape() method. Applications that rely on this utility to sanitize user-controlled input before embedding it in JavaScript contexts can be tricked into emitting attacker-controlled script.

A successful attack runs arbitrary JavaScript in the victim's browser session. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Spring released an advisory tracking the issue with broad version coverage across the 5.3, 6.1, 6.2, and 7.0 branches.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions in the context of authenticated users.

Affected Products

Spring Framework 7.0.0 through 7.0.7
Spring Framework 6.2.0 through 6.2.18 and 6.1.0 through 6.1.27
Spring Framework 5.3.0 through 5.3.48

Discovery Timeline

2026-06-09 - CVE-2026-41845 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41845

Vulnerability Analysis

The Spring Framework provides JavaScriptUtils.javaScriptEscape() as a helper for escaping strings that developers embed directly into JavaScript code rendered within HTML responses. The utility is intended to neutralize characters that could break out of a string literal or introduce executable script.

Due to incorrect escaping logic, certain character sequences pass through the function without being properly neutralized. Attackers who control input flowing through this utility can break out of the intended JavaScript string context. The resulting output executes as script in the user's browser when the page renders.

Exploitation requires user interaction, typically by enticing a victim to visit a crafted URL or interact with a malicious page. The attack runs over the network without authentication. The impact is high for confidentiality because attackers can read session cookies, document state, and any data accessible to the page's JavaScript context.

Root Cause

The root cause is incomplete character escaping inside JavaScriptUtils.javaScriptEscape(). The function fails to encode characters that allow attackers to terminate the surrounding JavaScript string literal or introduce a new execution context. Developers who trust the helper inherit the gap directly into their rendered pages.

Attack Vector

An attacker supplies a malicious payload through any input field that the application later renders through JavaScriptUtils.javaScriptEscape(). Typical injection sinks include inline <script> blocks that embed server-side variables. When the victim loads the response, the unescaped payload executes in the browser. Refer to the Spring Security Advisory for technical specifics on the affected escaping sequences.

Detection Methods for CVE-2026-41845

Indicators of Compromise

Unexpected outbound requests from user browsers to attacker-controlled domains following interaction with Spring-based web applications.
HTTP request logs containing payloads with JavaScript breakout characters such as backslashes, line separators (U+2028, U+2029), or unescaped quote sequences targeting Spring endpoints.
Server-rendered pages where dynamic content appears inside <script> blocks alongside reflected user input.

Detection Strategies

Audit application source code for calls to JavaScriptUtils.javaScriptEscape() and identify any code paths that pass user-controlled data through the helper into inline JavaScript.
Deploy web application firewall (WAF) rules that flag JavaScript breakout sequences in query parameters, form fields, and JSON payloads sent to Spring endpoints.
Run dynamic application security testing (DAST) scans focused on reflected and stored XSS against pages that embed server data inside script contexts.

Monitoring Recommendations

Centralize web server and application logs to detect anomalous query strings containing escape sequences targeting JavaScript contexts.
Configure Content Security Policy (CSP) violation reporting endpoints to capture blocked inline-script executions and unexpected script sources.
Monitor browser telemetry and endpoint detection signals for child-process spawns or credential-prompt anomalies originating from web sessions.

How to Mitigate CVE-2026-41845

Immediate Actions Required

Upgrade Spring Framework to a patched maintenance release outside the vulnerable ranges (5.3.x, 6.1.x, 6.2.x, 7.0.x) as listed in the Spring Security Advisory.
Inventory every application module that depends on JavaScriptUtils.javaScriptEscape() and prioritize remediation for internet-facing services.
Enforce a strict Content Security Policy that disallows inline scripts to blunt exploitation while patching proceeds.

Patch Information

VMware and the Spring team have published fixed versions across the supported branches. Refer to the Spring Security Advisory for the exact patched version numbers and upgrade guidance. Commercial support customers on out-of-OSS-support branches should consult Spring's extended support channels.

Workarounds

Replace direct use of JavaScriptUtils.javaScriptEscape() with context-aware output encoding from a vetted library such as OWASP Java Encoder (Encode.forJavaScript()).
Avoid embedding user-controlled data directly inside <script> blocks by passing values through JSON data attributes and reading them with safe DOM APIs.
Apply input validation at trust boundaries to reject characters that have no business appearing in the fields rendered to JavaScript contexts.

bash

# Maven dependency update example - replace with the patched version from the Spring advisory
mvn versions:use-dep-version -Dincludes=org.springframework:spring-web -DdepVersion=<PATCHED_VERSION> -DforceVersion=true
mvn dependency:tree | grep spring-