AIKIDO-2026-10649
thymeleaf-spring6 is vulnerable to Expression Language Injection
91
Critical Risk
This Affects:
thymeleaf-spring6TL;DR
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
thymeleaf-spring6 is vulnerable to Expression Language Injection in versions 0.0.1 - 3.1.4.RELEASE.
How to fix this
Upgrade the org.thymeleaf:thymeleaf-spring6 library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant