Vulnerability GHSA-3chg-m5w7-qfv5
High Risk
HIGH RISK
CVSS Score: 7.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
June 09, 2026 at 06:31 AM UTC
Spring Framework Cross-site Scripting via JavaScriptUtils
1.0.0 - 1.0.1
1.0.0 - 1.0.1
Summary
Spring Framework Cross-site Scripting via JavaScriptUtils
Details
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Cross-site Scripting via JSP Form Tags
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-72pg-x5f8-j25j
1.0.0 - 1.0.1 GHSA-72pg-x5f8-j25j
Medium Risk
3 months ago
Spring Framework Open Redirect in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-h3qp-gqrc-q736
1.0.0 - 1.0.1 GHSA-h3qp-gqrc-q736
Medium Risk
3 months ago
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-mq64-j8f9-9gcj
1.0.0 - 1.0.1 GHSA-mq64-j8f9-9gcj
Impacted packages
Timeline
Published
3 months ago
June 09, 2026 at 06:31 AM UTC
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Last Modified
18 days ago
September 10, 2026 at 03:50 AM UTC