cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Spring、Java。CVE: CVE-2026-59281。