CVE-2026-41846mediumCWE-79

CVE-2026-41846: fallo de gravedad media en Spring Framework

Spring Framework Cross-site Scripting via JSP Form Tags

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Spring Framework+ Monitorear libspring-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.2%
Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Productos afectados
Spring · Spring Framework
CVEs relacionadas — Spring Framework

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5398HIGHRFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationEPSS 88.3%CVE-2024-22243HIGHCVE-2024-22243: Spring Framework URL Parsing with Host ValidationEPSS 4.0%CVE-2024-22259HIGHCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)EPSS 2.6%CVE-2020-5397MEDIUMCSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFluxEPSS 2.6%CVE-2024-22262HIGHCVE-2024-22262: Spring Framework URL Parsing with Host ValidationEPSS 1.2%CVE-2023-34053MEDIUMSpring Framework server Web Observations DoS VulnerabilityEPSS 1.2%