7.1
High
CVE-2026-41845 Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the…
Description
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Framework 7.0 | 7.0.0 → < 7.0.7.1 | 7.0.7.1 |
| Spring Framework 6.2 | 6.2.0 → < 6.2.18.1 | 6.2.18.1 |
| Spring Framework 6.1 | 6.1.0 → < 6.1.28 | 6.1.28 |
| Spring Framework 5.3 | 5.3.0 → < 5.3.49 | 5.3.49 |
Other CVEs of Spring Framework
The 45 CVEs of Spring Framework →
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response…
3.7
Low
CVE-2026-59313
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
9.8
Critical
CVE-2026-59283
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable…
9.1
Critical
CVE-2026-59282
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a…
7.5
High