CVE-2026-41901: Improper Neutralization of Special Elements used in an Expression Language Statement

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous...

Thymeleaf security vulnerabilities

Thymeleaf is an open-source Java template engine developed by Thymeleaf projects. Versions of Thymeleaf prior to 3.1.5.RELEASE contained security vulnerabilities. These vulnerabilities stemmed from a security bypass in the expression execution mechanism, which could lead to server-side template...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta1) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0-beta1)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta1 Source cves: CVE-2026-41901 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (2.0.9) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.9)

org.thymeleaf:thymeleaf MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.9 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta5) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0-beta5)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta5 Source cves: CVE-2026-41901 Source advisory:...

org.thymeleaf.extras:thymeleaf-extras-tiles2 (1.0.0-beta2), org.thymeleaf:thymeleaf-spring3 (2.0.12) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.12)

org.thymeleaf:thymeleaf MAVEN version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf.extras:thymeleaf-extras-tiles2 1.0.0-beta2 - org.thymeleaf:thymeleaf-spring3 2.0.12 Source cves:...

org.thymeleaf:thymeleaf-spring3 (2.0.2) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.2)

org.thymeleaf:thymeleaf MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.2 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (2.0.3) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.3)

org.thymeleaf:thymeleaf MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.3 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.1.1) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.1.1)

org.thymeleaf:thymeleaf MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.1 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

com.connect-group:thymesheet (2.1.1), com.connect-group:thymesheet-spring3 (2.1.1) +7 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.1.1.release)

org.thymeleaf:thymeleaf MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.connect-group:thymesheet 2.1.1 - com.connect-group:thymesheet-spring3 2.1.1 -...

org.thymeleaf:thymeleaf-spring3 (2.1.0-m3) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.1.0-m3)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.1.0-m3 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

com.github.seratch:scalatra-thymeleaf-support_2.9.1 (>=1.0.0, <=2.0.1), com.github.seratch:scalatra-thymeleaf-support_2.9.2 (>=1.0.0, <=2.0.1) +3 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.8)

org.thymeleaf:thymeleaf MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.seratch:scalatra-thymeleaf-support2.9.1 =1.0.0, =1.0.0, =1.0.1, =1.0.2 - org.thymeleaf:thymeleaf-sprin...

org.thymeleaf:thymeleaf-spring3 (1.0.1) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.1)

org.thymeleaf:thymeleaf MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.1 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

com.github.dandelion:dandelion-thymeleaf (>=0.2.0, <=0.2.1), com.github.dandelion:datatables-thymeleaf (>=0.8.8, <=0.8.14) +6 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.16)

org.thymeleaf:thymeleaf MAVEN version 2.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:dandelion-thymeleaf =0.2.0, =0.8.8, =0.2.1, =1.0.0, =0.0.1, =2.0.0-beta1, =2.0.7 Source cve...

com.github.dandelion:datatables-thymeleaf (>=0.9.0, <=0.9.2), nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect (>=1.1, <=1.1.3) +10 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.17)

org.thymeleaf:thymeleaf MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:datatables-thymeleaf =0.9.0, =1.1, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

GHSA-C9PH-GXWW-7744 Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed restricted contexts, it fails to...

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed restricted contexts, it fails to...

net.sourceforge.pagesdialect:pagesdialect-core (1.0.0-beta2), org.thymeleaf:thymeleaf-spring3 (2.0.6) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.6)

org.thymeleaf:thymeleaf MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - net.sourceforge.pagesdialect:pagesdialect-core 1.0.0-beta2 - org.thymeleaf:thymeleaf-spring3 2.0.6 Source cves:...

org.thymeleaf:thymeleaf-spring3 (1.0.0) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0)

org.thymeleaf:thymeleaf MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta2) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta2 Source cves: CVE-2026-41901 Source advisory:...