Medium severity · published Jul 30, 2026
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Spring Tools for Eclipse · Spring
through 5.2.0 · source: vendor
ST
Spring Tools · Broadcom
before 5.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59328
Vendor Advisory
https://spring.io/security/cve-2026-59328
More from Spring Tools for Eclipse
8.3
CVE-2026-47882
Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
8.0
CVE-2026-47873
Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
8.0
CVE-2026-47858
live information startup mode is vulnerable for remote code execution
4.4
CVE-2026-59327
Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
3.3
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server