Cross-site scripting in Spring Framework - CVE-2026-41846

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU146176

Cross-site scripting in Spring Framework - CVE-2026-41846

Published: August 28, 2026


Vulnerability identifier: #VU146176
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-41846
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject arbitrary html or javascript code.

The vulnerability exists due to cross-site scripting in JSP <form:*> tags when processing user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes. A remote attacker can supply crafted attribute values to inject arbitrary html or javascript code.

User interaction is required to trigger the injected content.


Affected software

Spring Framework
Db2 Developer Extension

How to mitigate CVE-2026-41846

Install security update from vendor's website.

Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8
Db2 Developer Extension - update to 1.2.0

External References

Related Security Bulletins