--- title: CVE-2026-59328: Cross-Site Scripting in Eclipse Spring... description: A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency... canonical: https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips | daily.dev og:description: A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency... og:url: https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku og:image: https://api.daily.dev/og/posts/4kG7UcPkU.png og:image:alt: CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips **[Spring](https://daily.dev/sources/spring)** · 1 min read · 11 upvotes · 1 comments ## Summary A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency tooltips. The advisory is hosted on spring.io and relates to the Eclipse IDE plugin used for Spring Boot project setup. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > Developer tooling is easy to overlook because it sits outside the deployed app, yet it often runs with broad trust on an engineer’s machine. Patch speed helps, but organizations also need a reliable way to inventory IDE plugin versions and spot stale installations. ## Similar posts on daily.dev - [CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations](https://daily.dev/posts/cve-2026-59327-cleartext-storage-of-spring-boot-devtools-remote-secret-in-eclipse-launch-configurat-5xneum2cf) · Spring · 2 upvotes · 0 comments - [CVE-2026-22718: Command injection on user machine using VSCode extension for Spring CLI](https://daily.dev/posts/cve-2026-22718-command-injection-on-user-machine-using-vscode-extension-for-spring-cli-qah3dxopu) · Spring · 1 upvotes · 0 comments - [foojay – a place for friends of OpenJDK](https://daily.dev/posts/foojay-a-place-for-friends-of-openjdk-rdat3ew2h) · Foojay.io · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot) [View this post on daily.dev](https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips","url":"https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku"},"datePublished":"2026-07-29T19:54:58.662Z","dateModified":"2026-09-14T07:40:00.809Z","description":"A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Spring","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Spring","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/spring","url":"https://daily.dev/sources/spring"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,java,spring-boot","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Spring","item":"https://daily.dev/sources/spring"},{"@type":"ListItem","position":3,"name":"CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-59328-cross-site-scripting-in-eclipse-spring-boot-starter-wizard-dependency-tooltips-4kg7ucpku","comment":[{"@type":"Comment","text":"Developer tooling is easy to overlook because it sits outside the deployed app, yet it often runs with broad trust on an engineer’s machine. Patch speed helps, but organizations also need a reliable way to inventory IDE plugin versions and spot stale installations.","datePublished":"2026-07-30T02:39:42.276Z","url":"https://daily.dev/posts/4kG7UcPkU#c-NG4kK5UL4","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} ```