Server-Side Template Injection bypass in Thymeleaf (CVE-2026-40477)

A security bypass vulnerability in Thymeleaf's expression execution mechanisms fails to properly restrict the scope of accessible objects within templates, allowing sensitive objects to be reached from template context. When application developers pass unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's built-in protections to achieve Server-Side Template Injection (SSTI). Affected versions: - org.thymeleaf:thymeleaf <= 3.1.3.RELEASE - org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE - org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE We recommend updating to: 3.1.4.RELEASE. CVSS 9.0 · our assessment: act_now Reference: https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr Details: https://vuln.today/cve/CVE-2026-40477