EUVD-2026-50975
GHSA-xf7f-942v-xgqh
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H because exploitation requires a pre-compromised Initializr endpoint; UI:R for required tooltip hover; C:L/I:L reflect beaconing and spoofing only, no availability impact.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
AnalysisAI
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the developer's Spring Tools for Eclipse instance is configured to use a Spring Initializr endpoint that the attacker controls or has compromised - this is the non-default, non-trivial prerequisite that drives the AC:H rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.2 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N accurately reflects the real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised an organization's internal Spring Initializr mirror (or who has performed DNS/BGP hijacking of a custom endpoint) injects malicious JavaScript into the tooltip HTML served for a dependency entry. When a developer opens the New Spring Starter Project wizard, configures it to use that endpoint, and hovers over a dependency checkbox to read the tooltip, the injected script silently executes inside the SWT embedded browser - enabling the attacker to spoof wizard UI elements or beacon the developer's network identity and IDE context to an external server. … |
| Remediation | The primary remediation is to upgrade Spring Tools for Eclipse to a version beyond 5.2.0, which is the boundary confirmed by the vendor advisory at https://spring.io/security/cve-2026-59328 - however, an exact fixed version number is not independently confirmed from the available input data (see Confidence Notes). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today