Description

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker.

Pre-conditions:

• The application uses the "org.springframework.webflow:spring-js-resources" artifact.
• Spring-Dojo.js loaded and used for Ajax requests.

Affected Spring Products and Versions

Spring Web Flow:

• 4.0.0 - 4.0.0
• 3.0.0 - 3.0.1
• 2.5.0 - 2.5.1
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.