Starting Spring Boot applications in the Spring Tools with the live information mode enabled exposes the running application to JMX‑based remote code execution. The vulnerability arises because the live information startup mode allows an attacker to access JMX interfaces without proper authentication, matching CWE‑306. This can let an attacker run arbitrary code within the context of the application, compromising confidentiality, integrity, and availability of the application and any data it processes.

Spring Tools for Eclipse version 5.2.0 and earlier, and Spring Tools for VSCode, Cursor, and Theia version 2.2.0 and earlier are affected.

The CVSS score of 8 indicates a high‑severity flaw. However, the EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker establishing a JMX connection to the running Spring Boot application and executing code through the unprotected live information mode. Exploitation requires network access to the application’s JMX port and the application must be running with the live information mode enabled.