Loading vulnerability…
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
CVE-2026-59328 is a cross-site scripting vulnerability in Spring Tools for Eclipse affecting version 5.2.0 and earlier. The Spring Boot starter project wizard renders dependency tooltips inside a native embedded browser component based on SWT Browser with JavaScript enabled. When the wizard is configured to use an untrusted or compromised Initializr endpoint, attacker-controlled tooltip content can be rendered and executed as script when a developer hovers over a dependency checkbox in the New Spring Starter Project wizard. The issue results in script execution within the IDE’s embedded browser context rather than native code execution on the host.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the embedded browser used by the IDE wizard UI. The documented impact is limited to in-IDE interface spoofing and outbound network beaconing from the embedded browser context, and does not provide full operating-system-level code execution based on the available information.
If you can’t patch tonight, do this now.
Avoid using untrusted or compromised Initializr endpoints for the Spring Boot starter wizard until an updated fixed release is deployed. Restrict the wizard to trusted Initializr sources under administrative control.
Patch, then assume compromise.
Upgrade Spring Tools for Eclipse to a version newer than 5.2.0 once a fixed release is available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.