Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-41846: Spring Framework Cross-site Scripting via JSP Form Tags
Description
Spring MVC applications which accept user-supplied values in the cssClass,
cssErrorClass, or cssStyle attributes of JSP <form:*> tags allow arbitrary
HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS)
vulnerability.
Affected Spring Products and Versions
Spring Framework:
- 7.0.0 - 7.0.7
- 6.2.0 - 6.2.18
- 6.1.0 - 6.1.27
- 5.3.0 - 5.3.48
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 7.0.x | 7.0.8 | OSS |
| 7.0.7.1 | Commercial | |
| 6.2.x | 6.2.19 | OSS |
| 6.2.18.1 | Commercial | |
| 6.1.x | 6.1.28 | Commercial |
| 5.3.x | 5.3.49 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was discovered internally.
References
History
- 2026-06-08: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all