THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-40986 (MEDIUM 4.8) — Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected fro

[NVD] CVE-2026-40986 (MEDIUM 4.8) — Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected fro

lownvdPublished 2026-06-11

CVE-2026-40986 CVSS: 4.8 MEDIUM Published: 2026-06-11T07:16:26.920

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker.

Affected versions: Spring Web Flow 4

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-40986cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40986