https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:03:33 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07527 bdu:2026-07527 https://cve.radiocsirt.org/vuln/bdu:2026-07527 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-317955 EUVD-2026-317955 https://cve.radiocsirt.org/vuln/euvd-2026-317955 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41901 <p>Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.</p> <p>Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41901 https://cve.radiocsirt.org/vuln/ghsa-c9ph-gxww-7744 <p><strong>Affected:</strong> Maven: org.thymeleaf:thymeleaf, Maven: org.thymeleaf:thymeleaf-spring5, Maven: org.thymeleaf:thymeleaf-spring6</p> <p>### Impact</p> <p>A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).</p> <p>### Patches</p> <p>This has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately.</p> <p>### Workarounds</p> <p>No workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.</p> <p><strong>Affected:</strong> Maven: org.thymeleaf:thymeleaf, Maven: org.thymeleaf:thymeleaf-spring5, Maven: org.thymeleaf:thymeleaf-spring6</p> <p>### Impact</p> <p>A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).</p> <p>### Patches</p> <p>This has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately.</p> <p>### Workarounds</p> <p>No workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.</p> https://cve.radiocsirt.org/vuln/ghsa-c9ph-gxww-7744