CVE-2026-41845
HighAdvisory
Published 9 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.1
- base score, highest
- EPSS
- 0.002
- 6th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 297
- of 17,781 indexed, latest versions
- Container images
- 254
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Framework Cross-site Scripting via JavaScriptUtils
Carried by container images the latest versions of 297 of 17,781 indexed charts deploy, on 254 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-webmvcmaven | 2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE, 4.3.2.RELEASE+87 more | 6.2.19, 7.0.8 | 254 |
- OSV records
- GHSA-3chg-m5w7-qfv5
Charts affected
297 by stars
Container images carrying it
254 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| svtechnmaa/ | 6e368ace0977 | spring-webmvc | no fix listed | 1 |
| sysnet4admin/ | bc25b152d88e | spring-webmvc | 6.2.19 | 1 |
| thingsboard/ | bd45a09d85d9 | spring-webmvc | no fix listed | 1 |
| thingsboard/ | a06f53c5e2da | spring-webmvc | no fix listed | 1 |
| thingsboard/ | 030f316ce301 | spring-webmvc | no fix listed | 1 |
| thingsboard/ | 645f43b688f7 | spring-webmvc | no fix listed | 1 |
| thingsboard/ | f40a542832c4 | spring-webmvc | no fix listed | 1 |
| thingsboard/ | 2d17e4e36edc | spring-webmvc | 6.2.19 | 1 |
| thmmniii/ | 5438517d9fc2 | spring-webmvc | no fix listed | 1 |
| treskon/ | 88e813f22347 | spring-webmvc | no fix listed | 1 |
| vientoprojects/ | eb2a71531741 | spring-webmvc | no fix listed | 1 |
| vincentgwzhang/ | a9139f2cd98f | spring-webmvc | 6.2.19 | 1 |
| vlebediantsev/ | e7f20450d2ae | spring-webmvc | no fix listed | 1 |
| vlebediantsev/ | 10393a89b4a8 | spring-webmvc | no fix listed | 1 |
| vlebediantsev/ | df8bf38c535b | spring-webmvc | no fix listed | 1 |
| vlebediantsev/ | 427af418b75e | spring-webmvc | no fix listed | 1 |
| vlebediantsev/ | 9319437f3c8f | spring-webmvc | no fix listed | 1 |
| vrijbrp/ | 5c770c2ae48c | spring-webmvc | no fix listed | 1 |
| xuxueli/ | 640093c35fd6 | spring-webmvc | no fix listed | 1 |
| zahoriaut/ | b2de13916f3e | spring-webmvc | no fix listed | 1 |
| gcr.io/ | 0ee5f968d2ab | spring-webmvc | no fix listed | 1 |
| gcr.io/ | ae57b62291aa | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | d9d796a1b846 | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | acb8dbce38fd | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | cf85570b1324 | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | 3be878690629 | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | f1629ac5f9ec | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | 415323ef112b | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | 05002092c621 | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | 6fe372e4e481 | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | c4c52955814f | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | a7d0cc9e260a | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | 10006bc0f309 | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | 5de339b3d537 | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | 10de22c8cbce | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | a1b05567dbf6 | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | dab685e668d9 | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | 4569cae83c70 | spring-webmvc | 6.2.19 | 1 |
| ghcr.io/ | ef3670f7e0a8 | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | baa4fa9549dc | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | cdc0658c40fb | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | c1b37e821f72 | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | 41b45003c6b6 | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | 8368359c8dd0 | spring-webmvc | no fix listed | 1 |
| ghcr.io/ | 3b3670fce70b | spring-webmvc | 7.0.8 | 1 |
| ghcr.io/ | 0bc598b2ac9a | spring-webmvc | 6.2.19 | 1 |
| public.ecr.aws/ | 5d767569c976 | spring-webmvc | 6.2.19 | 1 |
| public.ecr.aws/ | e85f034bcf48 | spring-webmvc | 6.2.19 | 1 |
| quay.io/ | e383ba3e0966 | spring-webmvc | no fix listed | 1 |
| quay.io/ | 32a5b1887eab | spring-webmvc | no fix listed | 1 |