Loading vulnerability…
Thymeleaf Expression Sandbox Bypass Leading to Server-Side Template Injection
CVE-2026-40478 is an expression-execution security bypass in Thymeleaf 3.1.3.RELEASE and earlier. Applications that pass unvalidated attacker-controlled input into template expressions, view names, or fragment selectors can expose server-side template injection. In the Spring Expression Language execution path, checks for object instantiation fail to recognize whitespace variants accepted by the underlying parser, while incomplete type restrictions permit access to dangerous classes outside blocked packages. Together, these weaknesses allow unauthenticated remote attackers to execute unauthorized expressions, potentially enabling arbitrary file writes and remote code execution. Thymeleaf 3.1.4.RELEASE fixes the identified bypasses.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise application integrity through unauthorized expression evaluation and file creation or modification within the application process's filesystem permissions. With suitable classes available on the classpath, exploitation can escalate to arbitrary code execution, potentially compromising the confidentiality, integrity, and availability of the affected application and resources accessible to its runtime identity. Installing an affected version alone does not establish exploitability; an unsafe input flow into expression parsing is required.
If you can’t patch tonight, do this now.
Keep untrusted input as template data rather than executable expression text. Do not construct expressions from request values or allow users to directly select parsed view names or fragment selectors; use fixed, application-controlled mappings instead. Do not rely on restricted execution mode or type blocklists as a complete security boundary. No separate workaround is identified beyond upgrading and removing unsafe input flows.
Patch, then assume compromise.
Upgrade all deployed Thymeleaf artifacts, including thymeleaf, thymeleaf-spring5, and thymeleaf-spring6 where present, to 3.1.4.RELEASE or a later fixed release. The fixes broaden whitespace normalization and external-access detection, restrict dangerous expression objects and types, and strengthen Spring MVC view-name checks. Audit application code to eliminate flows that turn untrusted request data into executable expressions, view names, or fragment selectors.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.