AIKIDO-2026-294135
spring-webmvc is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
spring-webmvcTL;DR
spring-web and spring-webflux EscapedErrors does not HTML-escape values returned by the no-argument getFieldErrors() and getFieldError() accessors. Applications that enable HTML escaping and then render those accessors can inject HTML or JavaScript into the page. That is reflected XSS. The patch escapes field errors from those accessors as well.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and HTML-escaped Errors field errors are rendered with the no-argument getFieldErrors() or getFieldError() accessors.
Background info
spring-webmvc is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 7.0.8.
How to fix this
Upgrade the org.springframework:spring-webmvc and/or the org.springframework:spring-webflux library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant