CVE-2026-41845 is a high-severity cross-site scripting vulnerability in the Spring Framework caused by incorrect escaping in the JavaScriptUtils.javaScriptEscape() method. This improper neutralization of input during web page generation can lead to JavaScript code injection in affected versions of the framework. The vulnerability impacts versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The CVSS vector indicates the attack is network accessible with low attack complexity, requires no privileges but does require user interaction, and results in high confidentiality impact with limited integrity impact and no availability impact. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to the disclosure of sensitive information to the attacker. The integrity impact is limited, and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds or additional input validation and output encoding controls where possible to mitigate the risk of JavaScript injection via the affected method.