CVE-2026-41846: Spring Framework Cross-site Scripting via JSP Form Tags
Summary
CVE-2026-41846: Spring Framework Cross-site Scripting via JSP Form Tags. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, particularly web applications. It provides comprehensive infrastructure support for developing Java applications, including features for dependency injection, transaction management, and web MVC architecture. However, certain versions of the Spring Framework, specifically those related to the spring-webmvc package, have been found vulnerable to cross-site scripting (XSS) attacks when user-supplied values are accepted in specific JSP form tag attributes.
Vulnerability Detail
The vulnerability arises from the improper handling of user-supplied input in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags. This flaw allows attackers to inject arbitrary HTML or JavaScript code, leading to potential XSS attacks. If exploited, this vulnerability can compromise user sessions, redirect users to malicious sites, or execute unauthorized actions on behalf of users. The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs before they are rendered in JSP form tags to prevent XSS attacks. This can be done using libraries like OWASP Java HTML Sanitizer or by manually escaping HTML characters in user inputs.
Conclusion
In summary, CVE-2026-41846 is a significant vulnerability in the Spring Framework that can lead to serious security risks through XSS attacks. It is crucial to update to the latest patched versions of the spring-webmvc package to ensure the security of your applications. Additionally, consider using input sanitization as a temporary measure until the update can be applied.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2026-41846 is a vulnerability in the Spring Framework that allows cross-site scripting (XSS) through JSP form tags.
Affected versions include Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, and 5.3.0 to 5.3.48.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If immediate updates are not possible, implement input sanitization as a temporary workaround to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
