8.1Yüksek
CVE-2026-59286Spring for GraphQL loads Untrusted Resources in GraphiQL support
Açıklama
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Zayıflık türü (CWE):
CWE-494
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 – ≤ 2.0.4, 1.4.0 – ≤ 1.4.6, 1.1.0 – ≤ 1.3.9, 1.0.0 – ≤ 1.0.7 | |
| vmware | spring for graphql | 1.0.0 – < 1.0.8 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-59286 Vendor Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.0.0 < 1.0.8cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.1.0 < 1.3.10cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.7cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.4.1