Spring Framework 57 Reflected XSS via Errors.getFieldError()
CVE-2026-59281 Published on August 27, 2026
Spring Framework Cross-site Scripting via EscapedErrors
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Products Associated with CVE-2026-59281
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Framework:- Version 7.0.0, <= 7.0.8 is affected.
- Version 6.2.0, <= 6.2.19 is affected.
- Version 6.1.0, <= 6.1.28 is affected.
- Version 6.0.0, <= 6.0.30 is affected.
- Version 5.3.0, <= 5.3.49 is affected.
- Before and including 5.2.25.RELEASE is affected.