CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-59328

Summary: CVE-2026-59328 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue arises when the Spring Boot starter wizard’s dependency tooltips are rendered in a native embedded SWT Browser with JavaScript enabled, and untrusted/compromised Initializr endpoints are used. This can allow a...