CVE-2026-59328CWE-79cross-site-scripting

CVE-2026-59328

Medium · published July 30, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.

Affected Spring Products and Versions:

Spring Tools for Eclipse: 5.2.0 and earlier

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-30T10:25Z
Affected products (1)
ProductVersionsFixed in
broadcom/spring_tools< 5.3.05.3.0
References (1)
https://spring.io/security/cve-2026-59328 · [email protected]
EPSS history
Timeline
  • 30 JUL 05:29Z
    Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
    cvelistv5