Loading story…
A critical flaw tracked as CVE-2026-40478 allows attackers to bypass Thymeleaf’s expression-injection protections and achieve server-side template injection (SSTI) in applications that pass unvalidated user input into the template engine. The vulnerability affects Thymeleaf 3.1.3.RELEASE and earlier and stems from improper neutralization of syntax patterns in expression execution, including a whitespace parsing mismatch that let attackers evade detection of the SpEL new keyword and an incomplete type blocklist that still allowed dangerous class instantiation. The issue is mapped to CWE-917 and CWE-1336, with a published CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Researchers said successful exploitation can enable arbitrary file writes and potentially remote code execution in Spring-based Java applications, where Thymeleaf is commonly used as the default template engine in Spring Boot. The flaw can be exploited remotely without authentication when attacker-controlled input reaches Thymeleaf expression parsing, view names, or fragment selectors. The issue is addressed in 3.1.4.RELEASE, which normalizes whitespace before checks, expands external-access detection, restricts dangerous expression objects, and tightens type restrictions; defenders are urged to upgrade thymeleaf, thymeleaf-spring5, and thymeleaf-spring6 and review applications to ensure untrusted input is never interpreted as template expressions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE was published for a security bypass in Thymeleaf 3.1.3.RELEASE and earlier that can let an unauthenticated remote attacker achieve server-side template injection when applications pass unvalidated user input into template expressions. The issue was mapped to CWE-917 and CWE-1336 and referenced GitHub Security Advisory GHSA-xjw8-8c5c-9r79.
Thymeleaf addressed CVE-2026-40478 in version 3.1.4.RELEASE, fixing expression-sandbox bypasses caused by whitespace parsing mismatches and insufficient type restrictions. The update normalized whitespace before checks, expanded external-access detection, restricted dangerous expression objects, and tightened type restrictions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcecvefeed.io
Open sourceendorlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service flaw, **CVE-2026-41849**, was disclosed in the Spring Framework **SpEL** evaluation engine, where an integer overflow can let a remote, unauthenticated attacker exhaust resources if a network-exposed application evaluates attacker-controlled expressions. The issue affects **Spring Framework 5.3.0 through 5.3.48** and carries a **CVSS 3.1 score of 7.5**, with impact limited to availability. Spring said the vulnerability applies to the **5.3.x** branch and that newer releases **6.2.19** and **7.0.8** are not affected. Public open-source remediation is available in those newer branches, while the fix for **5.3.x** is **5.3.49** and is available through commercial **Tanzu Spring Enterprise** because the 5.3 line has reached end of life; no public proof-of-concept or confirmed in-the-wild exploitation had been reported at publication time.
Jul 10, 2026
Spring disclosed **`CVE-2026-22732`**, a vulnerability in **Spring Security** in which HTTP security headers may not be written under certain conditions, weakening browser-side protections that applications rely on to reduce exposure to client-side attacks. The issue affects the framework’s handling of response headers, creating a risk that expected defenses are absent even when developers believe they are enabled. Belgium’s **CCB Safeonweb** warned that the flaw can enable **multiple types of client-side attacks** and urged organizations to **patch immediately**. The combined advisories indicate that teams using Spring Security should review affected versions, apply vendor fixes, and verify that critical response headers are being sent correctly to browsers after remediation.
Jun 29, 2026
A critical **server-side template injection** flaw tracked as `CVE-2026-54390` affects **JTL Shop** versions **5.2.0 through 5.7.1**, where unsanitized user input is passed to the **Smarty** template engine. The vulnerability allows **unauthenticated remote attackers** to inject malicious template syntax and access sensitive server-side information, including **database credentials** and **encryption keys**. On **JTL Shop 5.4.0 through 5.7.1**, the flaw can be escalated to **remote code execution** by abusing registered Smarty modifiers such as `unserialize` and `file_get_contents` to write a **webshell** into the web root and run arbitrary commands as the web server user. The issue has been rated **critical** with **CVSS 3.1 9.8** and **CVSS 4.0 9.3**, and affected organizations are advised to upgrade to **JTL Shop 5.7.2 or later** and ensure user input reaching the template engine is properly sanitized.
Jun 29, 2026