Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.
Recommended action: Upgrade to 3.1.5.RELEASE or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
Recommended action: Upgrade to 3.1.4.RELEASE or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
Recommended action: Upgrade to 3.1.4.RELEASE or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Recommended action: Upgrade to 3.0.13.RELEASE or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.