Description

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.

Affected Spring Products and Versions

Spring Tools for Eclipse:

• 5.2.0 and earlier

All versions prior to version 5 (no longer supported) are also affected.

Spring Tools for VSCode / Cursor / Theia are not affected, as the affected wizard and tooltip components are specific to the Eclipse IDE.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Workaround for unpatched versions: Only configure trusted Spring Initializr service URLs (avoid custom or untrusted endpoints), and ensure network access to the configured Initializr endpoint is not subject to man-in-the-middle interception (e.g. use HTTPS and a trusted network path).

References

• CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (4.2, Medium)

History

• 2026-07-29: Initial vulnerability report published.