CVE-2026-59328mediumCWE-79

Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.2epss 0.2%

probabilidad de explotación

0.2%top 94% de las CVE

explotación observada

noninguna fuente lo reporta

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Productos afectados

Spring · Spring Tools for Eclipse

Referencias

https://spring.io/security/cve-2026-59328