{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/spring-tools-for-theia/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8,"id":"CVE-2026-47858"},{"cvss":8,"id":"CVE-2026-47873"},{"cvss":8.3,"id":"CVE-2026-47882"},{"cvss":3.3,"id":"CVE-2026-59326"},{"cvss":4.4,"id":"CVE-2026-59327"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Spring Tools for Eclipse","Spring Tools for VSCode","Spring Tools for Cursor","Spring Tools for Theia"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ide","rce","spring-framework"],"_cs_type":"advisory","_cs_vendors":["VMware"],"content_html":"\u003cp\u003eVMware has released a security advisory (AV26-759) detailing six vulnerabilities affecting Spring Tools for Eclipse (versions \u0026lt;= 5.2.0) and Spring Tools for VSCode, Cursor, and Theia (versions \u0026lt;= 2.2.0). The vulnerabilities range from critical Remote Code Execution (RCE) flaws to information disclosure and Cross-Site Scripting (XSS).\u003c/p\u003e\n\u003cp\u003eThe most severe issue, CVE-2026-47858, allows for RCE via live information startup mode. Additionally, CVE-2026-47873 exposes JDWP and JMX ports on all network interfaces, providing a pathway for unauthenticated remote access to debugging and management interfaces. Other identified issues include the use of a non-cryptographic PRNG for DevTools remote secrets (CVE-2026-47882), plaintext logging of HTTP proxy credentials (CVE-2026-59326), insecure local storage of secrets in Eclipse launch configurations (CVE-2026-59327), and XSS in dependency tooltips (CVE-2026-59328). Organizations using these developer tools should prioritize updating to the latest versions to mitigate these risks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities could result in full system compromise, unauthorized access to developer environments, theft of sensitive credentials (proxy and remote secrets), and potential for lateral movement within a development network. These flaws directly impact the integrity and confidentiality of developer workstations and the software build pipelines they support.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Spring Tools for Eclipse to the latest version immediately to remediate CVE-2026-47858, CVE-2026-47873, CVE-2026-47882, CVE-2026-59326, CVE-2026-59327, and CVE-2026-59328.\u003c/li\u003e\n\u003cli\u003eUpdate Spring Tools for VSCode, Cursor, and Theia to the latest version to address these vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAudit developer workstations for insecure IDE configurations, particularly regarding exposed JDWP/JMX ports.\u003c/li\u003e\n\u003cli\u003eRotate any credentials that may have been logged in plaintext or stored insecurely due to CVE-2026-59326 and CVE-2026-59327.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-30T15:30:50Z","date_published":"2026-07-30T15:30:50Z","id":"https://feed.craftedsignal.io/briefs/2026-07-spring-tools-vulnerabilities/","summary":"Multiple vulnerabilities in Spring Tools for Eclipse and VSCode/Cursor/Theia allow for remote code execution, unauthorized service access, credential exposure, and cross-site scripting.","title":"Critical Vulnerabilities in Spring Tools IDE Extensions","url":"https://feed.craftedsignal.io/briefs/2026-07-spring-tools-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Spring Tools for Theia","version":"https://jsonfeed.org/version/1.1"}