VMwareCVE-2026-59328
VMware Spring Tools for Eclipse: spoofing
Medium4.2CVE-2026-59328 · Published Jul 30, 2026
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring Tools for Eclipse Product | <= 5.2.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79
More VMware advisories
All VMware| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 30 | VMware ESX contains an insufficient logging vulnerability | Low2.7 | 5.2.4+3 more |
| Jul 30 | VMware Cloud Foundation: authentication bypass | Critical9.8 | 9.1.0.0300+2 more |
| Jul 30 | VMware Cloud Foundation: path traversal | Critical9.8 | 9.1.0.0300+2 more |
| Jul 30 | VMware Cloud Foundation: out-of-bounds write | Critical9.3 | ESXi-9.1.0.0200-25557999+2 more |
| Jul 30 | VMware Cloud Foundation: out-of-bounds read | High7.6 | 5.2.3+4 more |
| Jul 30 | VMware Spring Tools for: secrets in logs | Low3.3 | No fix yet |