Cross-site scripting in Spring Framework - CVE-2026-41845

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU146174

Cross-site scripting in Spring Framework - CVE-2026-41845

Published: August 28, 2026


Vulnerability identifier: #VU146174
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-41845
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.

User interaction is required to load the affected content in a browser.


Affected software

Spring Framework
Db2 Developer Extension
IBM Sterling B2B Integrator
Crowd Data Center
Jira Service Management Data Center
Jira Software Data Center
IBM Sterling File Gateway

How to mitigate CVE-2026-41845

Install security update from vendor's website.

Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
Crowd Data Center - update to 7.2.2
Jira Service Management Data Center - update to 11.3.8
Jira Software Data Center - update to 11.3.8

External References

Related Security Bulletins