Spring MVC and WebFlux applications that retrieve a data‑binding Errors instance with HTML escaping enabled and render field errors using the no‑argument Errors.getFieldErrors() or Errors.getFieldError() methods can inject arbitrary HTML and JavaScript. This flaw arises from improper neutralization of user input during error rendering and is classified as CWE-79.

Affected components are the Spring Framework. Versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier are vulnerable.

Based on the description, the likely attack vector is crafted HTTP requests that trigger the error rendering path, allowing an attacker to embed malicious scripts that execute when a user views the error output. The CVSS score of 6.1 indicates a moderate severity reflected XSS. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalogue. Because the flaw is reflected and does not require authentication unless the target page is restricted, the potential impact could include confidentiality, integrity, and availability risks for users who view the affected pages, but this impact is inferred from the attack path and not explicitly stated in the description.