CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement
Monthly
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Kuadrant operator's internal WebAssembly shim can be made to skip Gateway-level authentication and rate-limiting checks in multi-tenant deployments when an authenticated user with Kubernetes/OpenShift RBAC permission to create or modify an HTTPRoute attached to a shared Gateway supplies a crafted path, header, or query match value. The value is not properly escaped during CEL predicate generation, so the predicate can be altered to bypass those policies while the request is still forwarded to the route backend. No public exploit identified at time of analysis, and exploitation is conditional on a shared/multi-tenant Gateway with Gateway-level auth and/or rate limiting configured, making this a genuine but conditional-priority issue rather than a mass-exploitation threat.
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Apache WSS4J versions 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all 2.x releases before 2.4.4 can accept SOAP messages in which a required element was never signed or encrypted, because the StAX streaming WS-SecurityPolicy validator converts relative or otherwise unsupported XPath expressions into paths that never match the real XML element path. The result is a fail-open integrity failure: a remote, unauthenticated SOAP peer (CVSS 3.1 AV:N/PR:N/UI:N) can send a policy-required element without the expected signature or encryption and the validator will not object. Exploitation is conditional on the deployment using WSS4J's StAX/streaming policy validator with a security policy whose SignedElements, EncryptedElements, or RequiredElements assertions use relative or unsupported XPath; our independent assessment rates the exploit vector AC:H and limits impact to integrity (I:H) with no confidentiality or availability effect, well below the vendor's 9.1 score, and no public exploit code has been identified at time of analysis.
Expression Language injection in Activiti through 7.1.0.M6 allows authenticated users to execute arbitrary code within the Spring application context. The ExpressionResolver fails to validate hash-brace deferred expressions (#{...}) when stored as process variables, meaning crafted payloads bypass the existing expression filter. When a BPMN mail task subsequently evaluates a variable-backed body field, the stored #{...} expression is resolved in the full Spring EL context, enabling method invocation on any registered application bean. No public exploit has been identified at time of analysis, and exploitation requires an authenticated user with process variable write access.
Remote code execution in beetl 3.20.2 allows unauthenticated remote attackers to execute arbitrary code via the type.new function and property reflection. Public proof-of-concept exploit code exists, though EPSS exploitation probability is low (0.24%) and no active exploitation has been reported to CISA KEV.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Expression language injection in Soagen Informatics' Apinizer API management platform versions 2026.04.0 through 2026.04.5 allows remote unauthenticated attackers to inject malicious EL expressions that the server evaluates, resulting in arbitrary code execution. The flaw was reported by Turkey's national CERT (TR-CERT) and carries a CVSS 9.8 critical rating, though SSVC currently indicates no observed exploitation and no public exploit identified at time of analysis. A vendor patch is available in version 2026.04.6.
Server-Side Expression Language (SpEL) injection in Spring Data REST allows authenticated remote attackers to execute arbitrary expressions by sending JSON Patch requests targeting Map-typed entity properties. Affected versions span 3.7.0 through 5.0.5, and successful exploitation yields high confidentiality and integrity impact (CVSS 8.1). No public exploit identified at time of analysis, but the low attack complexity and network reachability make this a credible threat to any exposed REST repository accepting application/json-patch+json.
Remote code execution risk in Spring Data MongoDB arises from a SpEL expression injection flaw (CWE-917) triggered during parameter binding for repository methods annotated with @Query that use a capture-all placeholder. With CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) and no public exploit identified at time of analysis, unauthenticated attackers who can influence query parameters reaching such a method could execute arbitrary SpEL expressions on the server.
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Kuadrant operator's internal WebAssembly shim can be made to skip Gateway-level authentication and rate-limiting checks in multi-tenant deployments when an authenticated user with Kubernetes/OpenShift RBAC permission to create or modify an HTTPRoute attached to a shared Gateway supplies a crafted path, header, or query match value. The value is not properly escaped during CEL predicate generation, so the predicate can be altered to bypass those policies while the request is still forwarded to the route backend. No public exploit identified at time of analysis, and exploitation is conditional on a shared/multi-tenant Gateway with Gateway-level auth and/or rate limiting configured, making this a genuine but conditional-priority issue rather than a mass-exploitation threat.
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Apache WSS4J versions 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all 2.x releases before 2.4.4 can accept SOAP messages in which a required element was never signed or encrypted, because the StAX streaming WS-SecurityPolicy validator converts relative or otherwise unsupported XPath expressions into paths that never match the real XML element path. The result is a fail-open integrity failure: a remote, unauthenticated SOAP peer (CVSS 3.1 AV:N/PR:N/UI:N) can send a policy-required element without the expected signature or encryption and the validator will not object. Exploitation is conditional on the deployment using WSS4J's StAX/streaming policy validator with a security policy whose SignedElements, EncryptedElements, or RequiredElements assertions use relative or unsupported XPath; our independent assessment rates the exploit vector AC:H and limits impact to integrity (I:H) with no confidentiality or availability effect, well below the vendor's 9.1 score, and no public exploit code has been identified at time of analysis.
Expression Language injection in Activiti through 7.1.0.M6 allows authenticated users to execute arbitrary code within the Spring application context. The ExpressionResolver fails to validate hash-brace deferred expressions (#{...}) when stored as process variables, meaning crafted payloads bypass the existing expression filter. When a BPMN mail task subsequently evaluates a variable-backed body field, the stored #{...} expression is resolved in the full Spring EL context, enabling method invocation on any registered application bean. No public exploit has been identified at time of analysis, and exploitation requires an authenticated user with process variable write access.
Remote code execution in beetl 3.20.2 allows unauthenticated remote attackers to execute arbitrary code via the type.new function and property reflection. Public proof-of-concept exploit code exists, though EPSS exploitation probability is low (0.24%) and no active exploitation has been reported to CISA KEV.
Host-level remote code execution in n8n (n8n-io) occurs when an authenticated user with workflow create or modify permissions crafts a malicious expression that bypasses the sanitizer in the legacy expression evaluator's computed-member handler, executing arbitrary code as the n8n process. Because the legacy expression engine is the default in affected versions, standard deployments are exposed without any special configuration. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and carries a high CVSS 4.0 base score of 8.9.
Expression language injection in Soagen Informatics' Apinizer API management platform versions 2026.04.0 through 2026.04.5 allows remote unauthenticated attackers to inject malicious EL expressions that the server evaluates, resulting in arbitrary code execution. The flaw was reported by Turkey's national CERT (TR-CERT) and carries a CVSS 9.8 critical rating, though SSVC currently indicates no observed exploitation and no public exploit identified at time of analysis. A vendor patch is available in version 2026.04.6.
Server-Side Expression Language (SpEL) injection in Spring Data REST allows authenticated remote attackers to execute arbitrary expressions by sending JSON Patch requests targeting Map-typed entity properties. Affected versions span 3.7.0 through 5.0.5, and successful exploitation yields high confidentiality and integrity impact (CVSS 8.1). No public exploit identified at time of analysis, but the low attack complexity and network reachability make this a credible threat to any exposed REST repository accepting application/json-patch+json.
Remote code execution risk in Spring Data MongoDB arises from a SpEL expression injection flaw (CWE-917) triggered during parameter binding for repository methods annotated with @Query that use a capture-all placeholder. With CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) and no public exploit identified at time of analysis, unauthenticated attackers who can influence query parameters reaching such a method could execute arbitrary SpEL expressions on the server.