Thymeleaf vulnerabilities

Thymeleaf, a Java template engine, has a security bypass vulnerability prior to version 3.1.5.RELEASE that allows for the execution of dangerous expressions. If an application developer passes unsanitized variables containing such expressions to the template engine, these expressions can be executed in sandboxed contexts, leading to Server-Side Template Injection (SSTI).

Thymeleaf versions up to 3.1.3.RELEASE contain a security bypass vulnerability in the expression execution mechanism. Although the library provides protections against expression injection, it fails to properly neutralize specific syntax patterns, allowing unauthorized expression execution. An unauthenticated remote attacker can exploit this to achieve Server-Side Template Injection (SSTI) if the application passes unvalidated user input directly to the template engine.

Thymeleaf versions up to 3.1.3.RELEASE contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides protection against expression injection, it fails to properly restrict the scope of accessible objects, allowing sensitive objects to be reached from within a template.