CVE-2026-59286

Spring for GraphQL ships a bundled GraphiQL page that loads its JavaScript libraries from a public CDN without Subresource Integrity (SRI) checks (CWE-494). An attacker who can tamper with those CDN-delivered scripts — for example by compromising the CDN, poisoning an intermediary cache, or intercepting traffic — can inject malicious JavaScript that runs in the browser of anyone loading the GraphiQL page, executing arbitrary code in that page's origin. Only applications running affected versions of Spring for GraphQL that actually expose the bundled GraphiQL page are affected, since deployments that never serve the page have no vulnerable attack surface. The flaw is scored 8.1 (High) with a network vector and high attack complexity, reflecting that the attacker must be able to modify the script delivery path rather than the application itself. There is no known exploitation, no public proof of concept, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to a fixed Spring for GraphQL release beyond the listed affected ranges per the VMware/Broadcom advisory (i.e., later than 2.0.4, 1.4.6, 1.3.9, and 1.0.7 on each branch). Until patched, avoid exposing the bundled GraphiQL page to untrusted users, self-host or bundle the CDN-loaded JavaScript locally, or add Subresource Integrity attributes to the loaded libraries. First check whether your applications serve the GraphiQL page at all, since deployments that never expose it are not impacted.