Skip to content
OpenAdvisories

Package · Maven

org.thymeleaf:thymeleaf-spring5

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.0
    CVE-2026-41901 Exploited Public exploit

    Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the exec…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf Maven
  • Critical 9.1
    CVE-2026-40478 Exploited

    Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

    Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expre…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring6 org.thymeleaf:thymeleaf-spring5 Maven
  • Critical 9.1
    CVE-2026-40477 Exploited Public exploit

    Improper restriction of the scope of accessible objects in Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expressio…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf-spring6 Maven
  • Critical 9.8
    CVE-2021-43466

    Template injection in thymeleaf-spring5

    In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.

    org.thymeleaf:thymeleaf-spring5 Maven