CVE-2026-59286

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 2.0.0 through 2.0.4 Spring for GraphQL versions 1.4.0 through 1.4.6 Spring for GraphQL versions 1.1.0 through 1.3.9 Spring for GraphQL versions 1.0.0 through 1.0.7

Description The GraphiQL page loads JavaScript libraries from a public CDN without Subresource Integrity (SRI) checks. SRI is a security feature that enables browsers to verify that resources they fetch are delivered without unexpected manipulation. This lack of verification allows an attacker to inject malicious code into the scripts, leading to arbitrary code execution in the browser of any user loading the GraphiQL page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.