Skip to content
OpenAdvisories

Weakness (CWE)

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement

Base Incomplete

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Avoid adding user-controlled data into an expression interpreter when possible.

  2. Implementation

    If user-controlled data must be added to an expression interpreter, one or more of the following should be performed:

    - Validate that the user input will not evaluate as an expression

    - Encode the user input in a way that ensures it is not evaluated as an expression

  3. System Configuration, Operation

    The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to "true".

Source: MITRE CWE-917

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-41901 Exploited Public exploit

    Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the exec…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf Maven
  • Critical 9.1
    CVE-2026-40477 Exploited Public exploit

    Improper restriction of the scope of accessible objects in Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring6 org.thymeleaf:thymeleaf-spring5 Maven
  • Critical 9.8
    CVE-2022-26134 Exploited · Ransomware Public exploit EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Jun 2, 2022
  • Critical 9.8
    CVE-2022-22963 Exploited Public exploit EPSS 100%

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …

    org.springframework.cloud:spring-cloud-function-context Maven
    KEV Aug 25, 2022
  • Critical 10.0
    CVE-2022-22947 Exploited Public exploit EPSS 98%

    Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

    org.springframework.cloud:spring-cloud-gateway Maven
    KEV May 16, 2022
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023
  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Critical 9.8
    CVE-2021-26084 Exploited · Ransomware Public exploit EPSS 100%

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2020-10199 Exploited Public exploit EPSS 99%

    Nexus Repository Manager 3 - Remote Code Execution

    Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

    org.sonatype.nexus:nexus-extdirect Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2010-1871 Exploited Public exploit EPSS 83%

    JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly…

    KEV Dec 10, 2021