CVE-2026-59286: CWE-494 Download of Code Without Integrity Check in Spring Spring for GraphQL

The vulnerability identified as CVE-2026-59286 affects Spring for GraphQL versions 1.0.0 through 2.0.4. The issue arises because the GraphiQL page bundled with the product loads JavaScript libraries from a public Content Delivery Network (CDN) without implementing Subresource Integrity (CWE-494). This missing integrity check means that if an attacker can compromise the CDN or intercept the script delivery, they can inject malicious JavaScript code. This code would then execute in the context of the browser loading the GraphiQL page, potentially leading to arbitrary code execution and compromising the user's environment.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the browser of anyone accessing the vulnerable GraphiQL page. This can lead to full compromise of the client environment, including data theft, session hijacking, or further attacks against the user. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the GraphiQL page or avoid using it in untrusted environments. Monitoring vendor channels for updates or patches is recommended to ensure timely remediation once available.