CVE-2026-59328

{
  "id": "CVE-2026-59328",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-30T06:25:55.920",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.\nAffected Spring Products and Versions:\nSpring Tools for Eclipse: 5.2.0 and earlier"
    },
    {
      "lang": "es",
      "value": "Spring Tools para Eclipse renderiza la información sobre herramientas de dependencia del asistente de inicio de Spring Boot en un navegador nativo incrustado (Navegador SWT) con JavaScript habilitado. El uso de puntos finales de Initializr no confiables y comprometidos para el asistente de inicio de Spring Boot puede resultar en la ejecución arbitraria de scripts dentro del navegador incrustado cuando un desarrollador pasa el cursor sobre una casilla de verificación de dependencia en el asistente de Nuevo Proyecto de Inicio de Spring. El impacto se limita a la suplantación de interfaz de usuario (UI) dentro del IDE y al balizamiento de red saliente en lugar de la ejecución completa de código.\nProductos y versiones de Spring afectados:\nSpring Tools para Eclipse: 5.2.0 y anteriores"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Tools for Eclipse",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "5.2.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-30T13:44:25.377171Z",
          "id": "CVE-2026-59328",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:eclipse:*:*",
              "versionEndExcluding": "5.3.0",
              "matchCriteriaId": "32B3B8F5-9BB0-496A-87C0-161B75ABE2F0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-59328",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}