CVE-2026-40478

Critical · CVSS 9.0

Thymeleaf — Server-Side Template Injection (SSTI) / Expression Language Injection security bypass

CVSS: 9.0; nvd
EPSS: 0.77%; 52th pct
KEV: No
Class: oss containerizable; CWE-917, CWE-1336, CWE-917

Description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Search profile — drives PoC discovery

Symbols expression injectionexpression executionIExpressionContextSpringELOgnlExpressionEvaluatorIStandardExpressionParserStandardExpressionParserth:textth:field__${~{[(${preprocessorexpression sandbox bypass

Keywords CVE-2026-40478Thymeleaf SSTIThymeleaf expression injectionThymeleaf security bypassThymeleaf template injectionThymeleaf 3.1.3 RCEGHSA-xjw8-8c5c-9r79Thymeleaf sandbox bypassThymeleaf CWE-1336Thymeleaf unauthorized expression execution

Versions: <= 3.1.3.RELEASE

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

bmvermeer/thymeleaf.CVE_2026_40478 needs review

recent activity

gh_search · Java

★ 1

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

Maven	org.thymeleaf:thymeleaf	0 → 3.1.4.RELEASE
Maven	org.thymeleaf:thymeleaf-spring5	0 → 3.1.4.RELEASE
Maven	org.thymeleaf:thymeleaf-spring6	0 → 3.1.4.RELEASE

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T06:30:14.000Z