Description

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution.

This affects the live information feature across all environments (Eclipse, Visual Studio Code, Theia, Cursor) except the recently introduced extension for Claude Code.

Affected Spring Products and Versions

Spring Tools for Eclipse:

• 5.2.0 and earlier

Spring Tools for VSCode / Cursor / Theia:

• 2.2.0 and earlier

All versions prior to version 5 (no longer supported) are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Spring Tools for Eclipse:

Spring Tools for VSCode / Cursor / Theia:

No further mitigation steps are necessary.

Workaround for unpatched versions: disable the live information enablement when starting Spring Boot applications from within the IDE.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H&version=3.1

History

• 2026-07-29: Initial vulnerability report published.