CVE-2026-40986

Overview

Spring Web Flow is a framework, built on Spring MVC, for defining and executing UI flows within web applications; its spring-js-resources artifact ships a bundled JavaScript library (Spring-Dojo.js) that provides client-side Ajax behaviors such as the RemotingHandler. A medium-severity vulnerability (CVE-2026-40986) has been identified in the JavaScript RemotingHandler, which renders the body of an Ajax error response as HTML even when the response is not declared as text/html. When a server error response reflects attacker-controlled input in its body, that input is inserted into the page as markup and any embedded script executes in the victim's browser.

Per OWASP, Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites; they occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user.

This issue affects >=2.5.0 <=2.5.1, >=3.0.0 <=3.0.1, and 4.0.0 of Spring Web Flow. Versions that are no longer supported are also affected.

‍

Details

Module Info

• Product: Spring Web Flow
• Affected packages: spring-js-resources
• Affected versions: >=2.5.0 <=2.5.1, >=3.0.0 <=3.0.1, 4.0.0
• GitHub repository: https://github.com/spring-projects/spring-webflow
• Published packages: https://central.sonatype.com/artifact/org.springframework.webflow/spring-js-resources
• Package manager: Maven
• Fixed in:
• NES for Spring Web Flow 2.5.x
• Spring Web Flow 4.0.1, 3.0.2 (OSS)

Vulnerability Info

The vulnerability is exploitable only when the application serves the org.springframework.webflow:spring-js-resources artifact and the bundled Spring-Dojo.js is loaded and used for Ajax requests. When an Ajax request handled by Spring.RemotingHandler returns an error response, the handler displays the response body in a dialog by calling setContent with the raw responseText:

dialog.setContent(ioArgs.xhr.responseText);

setContent inserts the supplied string into the dialog's DOM node as HTML, with no regard for the response Content-Type. If the server's error response echoes attacker-influenced input back in its body (for example, a request parameter reflected into an error message), the markup in that body is parsed and executed, resulting in a reflected cross-site scripting attack in the user's browser. The remediation makes the handler render the body as HTML only when the server explicitly returns a text/html Content-Type; otherwise the body is assigned via textContent, which escapes markup so no script can run.

‍

Mitigation

The affected Spring Web Flow lines that are End-of-Life will not receive further public security updates. The 2.5.x line in particular has no publicly available fix.

Users should take one of the following actions:

1. Upgrade to a supported fixed version where one is publicly available: Spring Web Flow 4.0.1 or 3.0.2.
2. For End-of-Life lines that have no publicly available fix, obtain continued security support through a commercial support partner like HeroDevs. NES for Spring Web Flow provides a drop-in patched build for affected lines.