CVE-2026-41845: Spring Framework Cross-site Scripting via JavaScriptUtils
Summary
CVE-2026-41845: Spring Framework Cross-site Scripting via JavaScriptUtils. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, certain versions of the Spring Framework are vulnerable to a cross-site scripting (XSS) issue due to improper escaping in the JavaScriptUtils class, which can lead to JavaScript code injection in the browser.
Vulnerability Detail
The vulnerability arises from incorrect escaping in the JavaScriptUtils.javaScriptEscape() method. This flaw allows attackers to inject malicious JavaScript code into web pages viewed by users, potentially leading to unauthorized actions, data theft, or session hijacking. The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot upgrade to a patched version immediately, consider implementing input validation and output encoding to mitigate the risk of XSS attacks. Ensure that any user-generated content is properly sanitized before being rendered in the browser.
Conclusion
CVE-2026-41845 is a significant vulnerability in the Spring Framework that can lead to cross-site scripting attacks. It is crucial for developers using affected versions to upgrade to the patched versions to ensure the security of their applications. Implementing workarounds can provide temporary relief, but a permanent fix is necessary.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2026-41845 is a vulnerability in the Spring Framework that allows for cross-site scripting (XSS) due to improper escaping in the JavaScriptUtils class.
Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file. You can also check your application using the Vulert playground without any signup.
If an immediate upgrade is not possible, implement input validation and output encoding to reduce the risk of XSS attacks.
The CVSS score for CVE-2026-41845 is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
