org.thymeleaf:thymeleaf-spring3 (1.0.0-beta2) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0-beta2)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta2 Source cves: CVE-2026-41901 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (2.1.0-m2) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.1.0-m2)

org.thymeleaf:thymeleaf MAVEN version 2.1.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.1.0-m2 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.0.0) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0)

org.thymeleaf:thymeleaf MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (2.0.0) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.0)

org.thymeleaf:thymeleaf MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.0 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.0.0-beta3) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.0.0-beta3)

org.thymeleaf:thymeleaf MAVEN version 1.0.0-beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.0.0-beta3 Source cves: CVE-2026-41901 Source advisory:...

org.thymeleaf:thymeleaf-spring3 (1.1.0) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.1.0)

org.thymeleaf:thymeleaf MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.0 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (1.1.5) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (1.1.5)

org.thymeleaf:thymeleaf MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 1.1.5 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

org.thymeleaf:thymeleaf-spring3 (2.0.7) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.7)

org.thymeleaf:thymeleaf MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.7 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

Expression Language Injection

Overview Affected versions of this package are vulnerable to Expression Language Injection when dynamically loading classes, which allows server-side template injection that crosses the intended sandbox boundary. An attacker can execute unauthorized expressions with the privileges of the server b...

org.thymeleaf:thymeleaf-spring3 (2.0.1) potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.1)

org.thymeleaf:thymeleaf MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - org.thymeleaf:thymeleaf-spring3 2.0.1 Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

com.github.dandelion:datatables-thymeleaf (>=0.9.0, <=0.9.2), nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect (>=1.1, <=1.1.3) +10 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf (2.0.17)

org.thymeleaf:thymeleaf MAVEN version 2.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.thymeleaf:thymeleaf and may be impacted: - com.github.dandelion:datatables-thymeleaf =0.9.0, =1.1, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga, =3.0.0-ga,...

PT-2026-36947

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.5.RELEASE Description A security bypass exists in the expression execution mechanisms of Thymeleaf. The library fails to properly neutralize specific constructs within sandboxed restricted contexts, allowing...

Thymeleaf Code Execution

The vulnerability of the JavaScript-based Thymeleaf engine is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-40478

A flaw was found in Thymeleaf, a server-side Java template engine. An unauthenticated remote attacker can exploit this vulnerability by providing unvalidated user input to the template engine. This bypasses existing security mechanisms, allowing for the execution of unauthorized expressions and...

CVE-2026-40477

A flaw was found in Thymeleaf, a server-side Java template engine. An unauthenticated remote attacker can exploit a security bypass vulnerability in the expression execution mechanisms. By providing unvalidated user input directly to the template engine, the attacker can bypass the library's...

CVE-2026-40478

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

CVE-2026-40477

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...