Spring MVC and WebFlux applications that retrieve a data‑binding Errors instance with HTML escaping enabled and render field errors using the no‑argument Errors.getFieldErrors() or Errors.getFieldError() methods are able to inject arbitrary HTML and JavaScript. The reflected cross‑site scripting can enable an attacker to steal session cookies, deface content, or execute malicious actions on behalf of the victim. This flaw arises from improper neutralization of user input during error rendering, classifiable as CWE‑79.

Affected components are the Spring Framework. Versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier are vulnerable.

The flaw is exploitable via crafted HTTP requests that trigger error rendering. An attacker can embed malicious scripts that execute in the context of users who view the error output. The vulnerability is reflected, requiring no persistent state, and does not require authentication unless the target page is restricted. While the CVSS score is not provided, reflected XSS typically poses high impact to confidentiality, integrity, and potentially availability. EPSS is not available and the vulnerability is not listed in the CISA KEV catalogue, yet any Spring application that relies on the affected error handling patterns remains at substantial risk.