Spring MVC applications that accept user input in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags do not properly neutralize this input during web page generation, leading to a cross-site scripting (CWE-79) vulnerability. This flaw allows attackers to inject arbitrary HTML or JavaScript code, potentially compromising the confidentiality of user data. The vulnerability affects Spring Framework versions 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The CVSS 3.1 base score is 5.9, with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor has not yet provided an official fix or remediation level.

Successful exploitation can lead to injection of arbitrary HTML or JavaScript code in affected Spring MVC applications, potentially resulting in disclosure of sensitive information or session hijacking. The confidentiality impact is high, while integrity impact is low and availability is not affected. Exploitation requires user interaction and has high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, developers should avoid accepting untrusted input in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags or implement manual input validation and output encoding to mitigate injection risks.