Spring Tools Eclipse CVE-2026-59328

Exploitation requires that the developer's Spring Tools for Eclipse instance is configured to use a Spring Initializr endpoint that the attacker controls or has compromised - this is the non-default, non-trivial prerequisite that drives the AC:H rating. The developer must then open the New Spring Starter Project wizard and hover over at least one dependency checkbox to trigger tooltip rendering. The CVSS PR:N reflects that the attacker requires no authentication to the developer's machine - the attack is delivered via the compromised server. UI:R confirms that the developer must actively interact with the tooltip UI element. Exploitation is limited to developers using Spring Tools for Eclipse ≤ 5.2.0; developers using official, uncompromised Initializr endpoints (https://start.spring.io) are not exposed under normal conditions. The impact ceiling - explicitly stated by the vendor - is in-IDE UI spoofing and outbound network beaconing, not host-level code execution.

The CVSS 3.1 base score of 4.2 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N accurately reflects the real-world risk profile. AC:H is the critical limiting factor: exploitation is gated on the attacker first controlling or compromising the Initializr endpoint configured by the developer - a prerequisite that substantially reduces opportunistic exploitation probability. UI:R further requires the developer to actively hover over a tooltip in the wizard. No EPSS score was provided in the input data; without it, base-rate exploitation probability cannot be quantified. No CISA KEV listing exists, and no public proof-of-concept code has been identified, both of which reduce urgency. The 'RCE' tag in the ENISA intelligence record is misleading and contradicted by the vendor description, which explicitly caps impact at UI spoofing and outbound network beaconing - not host OS code execution. The practical real-world risk is therefore lower than the tag suggests: this is a developer-targeted supply-chain-style attack requiring a compromised toolchain endpoint, with limited post-exploitation capability once triggered.

An attacker who has compromised an organization's internal Spring Initializr mirror (or who has performed DNS/BGP hijacking of a custom endpoint) injects malicious JavaScript into the tooltip HTML served for a dependency entry. When a developer opens the New Spring Starter Project wizard, configures it to use that endpoint, and hovers over a dependency checkbox to read the tooltip, the injected script silently executes inside the SWT embedded browser - enabling the attacker to spoof wizard UI elements or beacon the developer's network identity and IDE context to an external server. No public proof-of-concept has been identified, and exploitation requires controlling the upstream endpoint.