Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 오프라인 점검 도구 —— 제로 의존성, 단일 jar, 네트워크 불필요. CVSS 9.0 두 건의 SSTI 우회, 9일 만에 수정판이 두 번 나왔습니다. 먼저 "내가 어느 건에 해당하는가"를 답하고, 그다음 더 곤혹스러운 질문에 답합니다: 내 버전 라인에, 올릴 수 있는 수정판이 있나? 3.1.x 는 있습니다3.1.5.RELEASE로 올리면 끝. 3.0.x 및 이전 은 없습니다 —— 그리고 바로 그게 설치 규모가 가장 큰...

CLSA-2026-1784856214 TuxCare security update for org.thymeleaf (1 CVE)

TuxCare rebuilt 3 org.thymeleaf packages to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.1...

CLSA-2026-1784682981 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.1...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (CVE-2026-40477, CVE-2026-40478)

Summary There are vulnerabilities in thymeleaf-3.1.2.RELEASE.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40477, CVE-2026-40478. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-40477 DESCRIPTION: Thymeleaf is a server-side Java template engine...

CVE-2026-41901

A flaw was found in Thymeleaf, a server-side Java template engine. A security bypass vulnerability exists in its expression execution mechanisms, allowing specific constructs to be executed even in restricted sandboxed contexts. If an application developer passes unsanitized variables containing...

The vulnerability of the JavaScript-based Thymeleaf framework lies in the lack of measures taken to neutralize special elements used in the expression language. This allows attackers to execute Server Side Template Injection (SSTI) attacks.

The vulnerability of the JavaScript-based Thymeleaf framework is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to execute a Server Side Template Injection SSTI attack...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901

CVE-2026-41901 (Thymeleaf) describes a security bypass in the expression execution mechanisms of Thymeleaf prior to 3.1.5.RELEASE. In sandboxed contexts, unsanitized variables containing certain expressions could be executed, enabling Server-Side Template Injection (SSTI). The issue is fixed in 3...

CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

thymeleaf 安全漏洞

Thymeleaf is an open-source Java template engine developed by Thymeleaf projects. Versions of Thymeleaf prior to 3.1.5.RELEASE contained security vulnerabilities. These vulnerabilities stemmed from a security bypass in the expression execution mechanism, which could lead to server-side template...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed restricted contexts, it fails to...

GHSA-C9PH-GXWW-7744 Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed restricted contexts, it fails to...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

PT-2026-36947

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.5.RELEASE Description A security bypass exists in the expression execution mechanisms of Thymeleaf. The library fails to properly neutralize specific constructs within sandboxed restricted contexts, allowing...