Executive brief
Spring Framework is a widely-used Java framework that applications rely on to build web services and middleware. Applications using Spring Expression Language (SpEL) with SimpleEvaluationContext for evaluating user-supplied or dynamic expressions can be bypassed to execute arbitrary code when the SpEL compiler is enabled. An attacker could exploit this to achieve remote code execution, compromise sensitive data, or disrupt application availability.
Technical details
This vulnerability is a safety guard bypass in Spring Expression Language (SpEL) evaluation when using SimpleEvaluationContext combined with the SpEL expression compiler. The vulnerability allows attackers to circumvent the intended security restrictions that SimpleEvaluationContext provides, potentially gaining access to restricted methods and properties. The attack vector is network-based when the SpEL expressions are derived from user input or untrusted sources. Exploitation requires that SimpleEvaluationContext is used with SpEL compiler active; applications using StandardEvaluationContext or without the compiler enabled are not affected. The impact is arbitrary code execution within the application context. Patches are available for all affected versions.
Affected products
- Spring Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8
Timeline
- 2026-08-27: disclosed