CVE-2026-41845

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description Incorrect escaping in the javaScriptEscape() function of the JavaScriptUtils class may lead to JavaScript code injection in the browser, potentially resulting in cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites.

Recommendations As a temporary workaround, restrict the use of the javaScriptEscape() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.