Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40478Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Critical 9.1

In plain English

A critical-severity expression language injection in org.thymeleaf:thymeleaf-spring5 from thymeleaf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.thymeleaf:thymeleaf3.1.4.RELEASEGHSA-xjw8-8c5c-9r79
Mavenorg.thymeleaf:thymeleaf-spring53.1.4.RELEASEGHSA-xjw8-8c5c-9r79
Mavenorg.thymeleaf:thymeleaf-spring63.1.4.RELEASEGHSA-xjw8-8c5c-9r79

Affected products (as reported)

VendorProductVersions
thymeleaf thymeleaf < 3.1.4.RELEASE
thymeleaf org.thymeleaf:thymeleaf-spring5 < 3.1.4.RELEASE
thymeleaf org.thymeleaf:thymeleaf-spring6 < 3.1.4.RELEASE

Weakness: CWE-917, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References