Vulnerable Library - spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2021-43466
Vulnerable Library - thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Publish Date: 2021-11-09
URL: CVE-2021-43466
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 4.6%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qcj6-jqrg-4wp2
Release Date: 2021-11-09
Fix Resolution (thymeleaf-spring5): org.thymeleaf:thymeleaf-spring5:3.0.13.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 2.7.18
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-40478
Vulnerable Libraries - thymeleaf-spring5-3.0.11.RELEASE.jar, thymeleaf-3.0.11.RELEASE.jar
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
Publish Date: 2026-04-16
URL: CVE-2026-40478
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-40477
Vulnerable Libraries - thymeleaf-3.0.11.RELEASE.jar, thymeleaf-spring5-3.0.11.RELEASE.jar
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
Publish Date: 2026-04-16
URL: CVE-2026-40477
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2023-38286
Vulnerable Library - thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
Publish Date: 2023-07-14
URL: CVE-2023-38286
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7gj7-224w-vpr3
Release Date: 2023-07-14
Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Publish Date: 2021-11-09
URL: CVE-2021-43466
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 4.6%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qcj6-jqrg-4wp2
Release Date: 2021-11-09
Fix Resolution (thymeleaf-spring5): org.thymeleaf:thymeleaf-spring5:3.0.13.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 2.7.18
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Libraries - thymeleaf-spring5-3.0.11.RELEASE.jar, thymeleaf-3.0.11.RELEASE.jar
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
Publish Date: 2026-04-16
URL: CVE-2026-40478
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Libraries - thymeleaf-3.0.11.RELEASE.jar, thymeleaf-spring5-3.0.11.RELEASE.jar
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. Credits Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
Publish Date: 2026-04-16
URL: CVE-2026-40477
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
Publish Date: 2023-07-14
URL: CVE-2023-38286
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7gj7-224w-vpr3
Release Date: 2023-07-14
Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE
⛑️Automatic Remediation will be attempted for this issue.