CVE-2026-59281: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection. This results in a reflected cross-site scripting (XSS) vulnerability. Affected versions include Spring Framework 5.2.25.RELEASE and earlier, and all versions up to 7.0.8 in the 5.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x branches.

An attacker can inject arbitrary HTML or JavaScript code into web pages rendered by vulnerable Spring Framework applications, potentially leading to reflected XSS attacks. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of web content in the context of the victim's browser. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Spring Framework advisories for updates addressing this vulnerability. Until a fix is available, avoid rendering field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors with HTML escaping enabled, or implement additional input validation and output encoding as a temporary mitigation.