CVE-2026-59328

MEDIUM

Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Title source: cna
STIX 2.1

Description

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

References (1)

Core 1

Scores

CVSS v3 4.2
EPSS 0.0016
EPSS Percentile 5.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
Spring/Spring Tools for Eclipse < 5.2.0
Published Jul 30, 2026
Tracked Since Jul 30, 2026