Spring Framework CVE-2026-59281

Exploitation requires three concurrent server-side conditions: (1) the application uses Spring MVC or Spring WebFlux for request handling, (2) HTML escaping is explicitly enabled in the application's data-binding or view configuration, and (3) the application calls the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors when rendering field error output to the response. Exploitation is additionally limited by the requirement for victim user interaction (UI:R) - the victim must follow a crafted URL. Applications that use argument-bearing error accessor overloads, that do not enable HTML escaping, or that do not render raw field errors in responses are not exploitable. Authentication is not required from an attacker perspective (PR:N in CVSS); any user capable of submitting a URL to a victim is positioned to attempt the attack against a vulnerable endpoint.

The CVSS 6.1 medium score accurately captures the moderate real-world risk profile. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates the vulnerability is network-reachable with low attack complexity but requires victim interaction (clicking a crafted link), which limits mass exploitation. EPSS at 0.17% (7th percentile) is notably low, suggesting no meaningful exploitation pipeline has emerged. The vulnerability is not listed in CISA KEV, and no public exploit or POC code has been identified at time of analysis. However, the affected version range is exceptionally broad - spanning every major Spring Framework release train including the still-common 5.3.x and 6.x lines - which amplifies aggregate exposure across the Java enterprise ecosystem. The narrow exploitation conditions (HTML escaping must be enabled AND the specific no-arg accessors must be used) represent a real-world limiter: not all Spring applications will meet both criteria simultaneously, making this a medium-priority patch rather than an emergency response item. No conflicting signals exist between CVSS and the description - both consistently point to a reflected XSS requiring user interaction.

An attacker identifies a Spring MVC application with HTML escaping enabled that renders field validation errors using the vulnerable no-arg accessors. The attacker crafts a URL containing a malicious JavaScript payload embedded in a form field parameter, then socially engineers a logged-in user to click the link. When the application processes the request and renders the field error containing the unsanitized input, the script executes in the victim's browser, enabling session token theft, credential harvesting, or UI redressing. No public POC has been observed at time of analysis.