What is the CVSS score of CVE-2026-59328?

CVE-2026-59328 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Spring Tools Eclipse CVE-2026-59328

EUVD-2026-50975 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 vmware

GHSA-xf7f-942v-xgqh

XSS RCE Java Spring Spring Tools For Eclipse

4.2

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

AC:H because exploitation requires a pre-compromised Initializr endpoint; UI:R for required tooltip hover; C:L/I:L reflect beaconing and spoofing only, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:57 vuln.today

DescriptionCVE.org

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

AnalysisAI

Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Spring Tools for Eclipse (CPE: cpe:2.3:a:spring:spring_tools_for_eclipse:*:*:*:*:*:*:*:*) embeds a native SWT Browser component to render rich tooltip content for dependency options in the New Spring Starter Project wizard. The wizard fetches dependency metadata - including tooltip HTML - from a configurable Spring Initializr endpoint over HTTPS. Because JavaScript is enabled in the SWT Browser and the fetched tooltip content is rendered without sanitization, an attacker who controls or has compromised that Initializr endpoint can inject malicious script payloads into the tooltip markup. When the IDE renders the tooltip (triggered by the developer hovering a checkbox), the injected script executes within the embedded browser's process context. No CWE has been formally assigned, but the root cause class is consistent with CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting) applied to an embedded browser surface rather than a traditional web context.

RemediationAI

The primary remediation is to upgrade Spring Tools for Eclipse to a version beyond 5.2.0, which is the boundary confirmed by the vendor advisory at https://spring.io/security/cve-2026-59328 - however, an exact fixed version number is not independently confirmed from the available input data (see Confidence Notes). As a compensating control pending upgrade, developers should verify that their configured Initializr endpoint is set to the official https://start.spring.io and has not been altered to point to an internal or third-party mirror that could be compromised; changing this setting is low-risk and eliminates the primary attack vector. Organizations running private Initializr instances should audit those deployments for integrity. Disabling or restricting the New Spring Starter Project wizard entirely is a high-impact workaround that eliminates exposure but removes key IDE functionality.