Spring Web Flow's JavaScript RemotingHandler improperly renders the body of error responses as HTML even when the 'Content-Type' is not 'text/html'. Consequently, an attacker can embed script payloads in an error response that contains reflected input, leading to a scripting attack in the victim's browser. The vulnerability is a classic reflected XSS flaw, CWE-79, and can compromise confidentiality, integrity, or availability of the affected web application by allowing attackers to execute arbitrary client‑side code.

The affected package is Spring Web Flow, versions 4.0.0; 3.0.0 through 3.0.1; and 2.5.0 through 2.5.1. All users running these releases should verify their deployment and consult vendor advisories for patches.

With a CVSS score of 4.8 the vulnerability is medium‑low severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting a relatively low probability of exploitation. Nevertheless, if the application surfaces detailed error information that includes user supplied data, the attack path involves a standard web request that triggers an error, thereby making the vulnerability exploitable in a typical web scenario.