AIKIDO-2026-845613
spring-js-resources is vulnerable to Cross-site Scripting (XSS)
50
Medium Risk
This Affects:
spring-js-resourcesTL;DR
Spring Web Flow contains a cross-site scripting vulnerability in its JavaScript RemotingHandler. When processing Ajax error responses, the handler may render response content as HTML even when the response is not of type text/html. If an attacker can cause malicious input to be reflected in an error response, arbitrary JavaScript may be executed in the victim's browser.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you are using the org.springframework.webflow:spring-js-resources artifact.
Background info
spring-js-resources is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 2.5.1, 3.0.0 - 3.0.1 and 4.0.0 - 4.0.0.
How to fix this
Upgrade the org.springframework.webflow:spring-js-resources library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant