CVE-2026-59328

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Published 30 Jul 2026, 06:25 UTC Last modified 30 Jul 2026, 06:25 UTC

4.2

CVSS 3.1 MEDIUM base score CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Exploitability1.6

Impact2.5

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

Weakness classification is still awaiting analysis.

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security@vmware.com