CVE-2026-59286

Spring for GraphQL versions 1.0.0–1.0.7, 1.1.0–1.3.9, 1.4.0–1.4.6, and 2.0.0–2.0.4 are affected. The bundled GraphiQL page loads JavaScript libraries from a public CDN without Subresource Integrity checks, allowing an attacker to inject malicious code into those scripts and execute arbitrary code...