Server-Side Template Injection bypass in Thymeleaf (CVE-2026-40478)

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. The library fails to properly neutralize specific syntax patterns, allowing bypass of its expression injection protections. An unauthenticated remote attacker can exploit applications that pass unvalidated user input directly to the template engine to achieve Server-Side Template Injection (SSTI). Affected versions: - org.thymeleaf:thymeleaf <= 3.1.3.RELEASE - org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE - org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE We recommend updating to: 3.1.4.RELEASE. CVSS 9.0 · our assessment: act_now Reference: https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79 Details: https://vuln.today/cve/CVE-2026-40478