What is the CVSS score of EUVD-2026-35333?

EUVD-2026-35333 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by EUVD-2026-35333?

Spring Framework versions 5.3.0-7.0.7 contain an XSS vulnerability in JavaScript encoding that attackers can exploit to inject malicious scripts into user browsers and compromise sessions or steal…. A patch is available.

How to fix or mitigate EUVD-2026-35333?

Within 24 hours: Identify all applications using Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, or 7.0.0-7.0.7; prioritize by business criticality and user impact. Within 7 days: Deploy compensating controls including Web Application Firewall rules for JavaScript injection, Content-Security-Policy headers, and code audit for JavaScriptUtils.javaScriptEscape() usage; establish upgrade readiness plan. Within 30 days: Complete staging environment validation of patched Spring Framework versions; begin phased production deployment to non-critical applications first, progressing to business-critical systems.

Spring Framework EUVD-2026-35333

| CVE-2026-41845 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 vmware

GHSA-3chg-m5w7-qfv5

XSS Java Spring Framework Red Hat

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Red Hat

7.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 11, 2026 - 16:22 NVD

HIGH MEDIUM

CVSS changed

Jun 11, 2026 - 16:22 NVD

7.1 (HIGH) 6.1 (MEDIUM)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:08 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

21 maven packages depend on org.springframework:spring-webmvc (13 direct, 8 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Cross-site scripting in Spring Framework versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7 allows remote attackers to inject JavaScript into victim browsers when applications rely on JavaScriptUtils.javaScriptEscape() for output encoding. The flaw stems from incomplete escaping in this utility method, and successful exploitation requires user interaction (UI:R) such as visiting a crafted page. No public exploit has been identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

Spring Framework is the foundational application framework underlying Spring Boot and a large share of enterprise Java web applications (CPE: cpe:2.3:a:spring:spring_framework). The vulnerable component is JavaScriptUtils.javaScriptEscape(), a helper widely used by developers and Spring's own tag libraries (e.g., the <spring:escapeBody javaScriptEscape='true'> JSP tag) to render untrusted strings inside JavaScript contexts. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation): the escape routine fails to neutralize certain character sequences sufficient to break out of a JavaScript string literal or template context, allowing attacker-controlled data to be parsed as code by the browser.

RemediationAI

Upgrade Spring Framework to a fixed release on your branch - based on the affected ranges this means moving beyond 5.3.48, 6.1.27, 6.2.18, or 7.0.7 to the next vendor-released patched version as specified in the Spring advisory at https://spring.io/security/cve-2026-41845 (confirm the exact target version in that advisory, as published patched versions were not independently verified in the data provided). If immediate upgrade is not possible, audit code and templates for calls to JavaScriptUtils.javaScriptEscape() (and JSP tags that delegate to it such as <spring:escapeBody javaScriptEscape='true'> and the javaScriptEscape attribute on form/eval tags) and replace them with OWASP Java Encoder's Encode.forJavaScript() or context-appropriate JSON serialization, accepting the trade-off of code churn and the need to retest output rendering. As a defensive layer, deploy a strict Content-Security-Policy that forbids inline event handlers and uses nonces or hashes for inline scripts to blunt successful injection, recognising that strict CSP may break legacy inline scripts and require template refactoring.