Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
References
| Link | Resource |
|---|---|
| https://spring.io/security/cve-2026-59328 |
Configurations
No configuration.
History
30 Jul 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 |
30 Jul 2026, 06:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-30 06:25
Updated : 2026-07-30 14:17
NVD link : CVE-2026-59328
Mitre link : CVE-2026-59328
CVE.ORG link : CVE-2026-59328
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')