Loading...
Skip to main content
GeekWala

CVE-2026-41901 — Vulnerability in org.thymeleaf:thymeleaf-spring5...

CRITICAL

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

Published May 4, 2026Updated May 13, 2026Source: osv

Summary

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). ### Patches This has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately. ### Workarounds No workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.

Advisory Timeline

  • First published May 4, 2026 (161 days ago).
  • Last revised May 13, 2026 — 9 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.thymeleaf:thymeleaf-spring5 to 3.1.5.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.5.RELEASE for org.thymeleaf:thymeleaf-spring5 -->
Maven
Update org.thymeleaf:thymeleaf to 3.1.5.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.5.RELEASE for org.thymeleaf:thymeleaf -->
Maven
Update org.thymeleaf:thymeleaf-spring6 to 3.1.5.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.5.RELEASE for org.thymeleaf:thymeleaf-spring6 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (3).

PackageEcosystemAffectedFixed In
org.thymeleaf:thymeleaf-spring5
maven
3.0.10.RELEASE, 3.0.11.RELEASE, 3.0.12.RELEASE, 3.0.13.RELEASE (+19 more)3.1.5.RELEASE
org.thymeleaf:thymeleaf
maven
1.0.0, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3 (+78 more)3.1.5.RELEASE
org.thymeleaf:thymeleaf-spring6
maven
3.1.0.M1, 3.1.0.M2, 3.1.0.M3, 3.1.0.RC1 (+6 more)3.1.5.RELEASE

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-41901?
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2026-41901?
CVE-2026-41901 affects org.thymeleaf:thymeleaf-spring5, org.thymeleaf:thymeleaf and org.thymeleaf:thymeleaf-spring6. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-41901 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-c9ph-gxww-7744

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies