4.8
Medium
CVE-2026-40986 Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not…
Description
Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Web Flow 4.0 | 4.0.0 → < 4.0.0.1 | 4.0.0.1 |
| Spring Web Flow 3.0 | 3.0.0 → < 3.0.1.1 | 3.0.1.1 |
| Spring Web Flow 2.5 | 2.5.0 → < 2.5.2 | 2.5.2 |