Cross-site scripting in Spring Framework - CVE-2026-41846
Published: August 28, 2026
Vulnerability identifier: #VU146176
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-41846
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary html or javascript code.
The vulnerability exists due to cross-site scripting in JSP <form:*> tags when processing user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes. A remote attacker can supply crafted attribute values to inject arbitrary html or javascript code.
User interaction is required to trigger the injected content.
Affected software
Spring Framework
How to mitigate CVE-2026-41846
Install security update from vendor's website.
Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8