The vulnerability arises from incorrect escaping in the JavaScriptUtils.javaScriptEscape() function within the Spring Framework, which may allow JavaScript code injection in the browser. This improper neutralization of input during web page generation is classified under CWE-79 (Cross-site Scripting). Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation could allow an attacker to inject malicious JavaScript code into users' browsers, potentially leading to the disclosure of sensitive information (high confidentiality impact). The integrity impact is low, and availability is not affected. This could compromise user trust and data confidentiality in applications using the affected Spring Framework versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as avoiding the use of the vulnerable JavaScriptUtils.javaScriptEscape() method or implementing additional input validation and output encoding controls in their applications. Monitor official Spring Framework advisories for updates and patches.