A crafted dependency list returned by an untrusted or compromised Initializr endpoint can cause the Eclipse Spring Tools for Eclipse wizard to render malicious JavaScript in its embedded SWT Browser. When a developer hovers over a dependency checkbox in the New Spring Starter Project wizard, the malicious script runs inside the IDE’s browser context. The attack is limited to user‑interface spoofing and outbound network beaconing; it does not grant full code execution or system compromise. The likely attack vector is reliance on an untrusted Initializr service that supplies unvalidated content to the wizard.

All users of Spring Tools for Eclipse 5.2.0 and earlier are affected when they launch the New Spring Starter Project wizard and use a compromised Initializr endpoint. The vulnerability does not extend to newer releases such as 5.3.0 and later.

The CVSS score of 4.2 indicates a medium risk, and the EPSS score of less than 1 % shows a very low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to be within the IDE and to have the wizard open; the attacker can influence the user experience and cause the IDE to send network beaconing traffic.