Vulnerability · Published Jul 30, 2026 · Assigned by vmware

CVE-2026-59328Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Medium 4.2

In plain English

A medium-severity cross-site scripting in Spring Tools for Eclipse from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Tools for Eclipse	0 – through 5.2.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://spring.io/security/cve-2026-59328