Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.thymeleaf:thymeleaf-spring5

4 known vulnerabilities (3 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 critical
Dependents
3
Registry
Maven Central

Advisories 4

  • CVE-2026-41901Critical 9.0

    Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

    Affected: fixed in 3.1.5.RELEASE.

  • CVE-2026-40478Critical 9.1

    Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

    Affected: fixed in 3.1.4.RELEASE.

  • CVE-2026-40477Critical 9.1

    Improper restriction of the scope of accessible objects in Thymeleaf expressions

    Affected: fixed in 3.1.4.RELEASE.

  • In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code…

    Affected: fixed in 3.0.13.RELEASE.