Executive brief
Thymeleaf, a widely used Java tool for generating web pages, contains a security flaw that could allow attackers to take control of a server. If an application using Thymeleaf accepts unvalidated user input, an attacker can bypass built-in security restrictions to execute unauthorized commands. This could lead to a total compromise of the server, including the theft of sensitive data or disruption of services.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in Thymeleaf due to improper restriction of the scope of accessible objects within its expression execution mechanisms. While the library includes protections against expression injection, it fails to adequately restrict access to sensitive objects, which can be reached from within a template. An unauthenticated remote attacker can exploit this by providing malicious input to an application that passes unvalidated data directly to the template engine. This allows the attacker to bypass security restrictions and achieve arbitrary code execution on the server. The issue is tracked as CWE-917 and CWE-1336 and has been resolved in version 3.1.4.RELEASE.
Affected products
- Thymeleaf Thymeleaf <= 3.1.3.RELEASE
- Thymeleaf thymeleaf-spring5 <= 3.1.3.RELEASE
- Thymeleaf thymeleaf-spring6 <= 3.1.3.RELEASE
- Red Hat OpenShift Dev Spaces 3.28
- Red Hat Fuse 7 7
- Red Hat Single Sign-On 7 7
Timeline
- 2026-04-15: advisory: GitHub Security Advisory published by Thymeleaf developers
- 2026-04-17: disclosed: CVE published to NVD
- 2026-05-28: patched: Red Hat released security advisory RHSA-2026:21772 for OpenShift Dev Spaces
References
- https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/security/cve/CVE-2026-40477
- https://bugzilla.redhat.com/show_bug.cgi?id=2459344
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40477.json