Vulnerable Library - spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Mend has checked all newer package trees, and you are on the least vulnerable package!
Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2021-43466
Vulnerable Library - thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Publish Date: 2021-11-09
URL: CVE-2021-43466
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 4.592%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qcj6-jqrg-4wp2
Release Date: 2021-11-09
Fix Resolution: org.thymeleaf:thymeleaf-spring5:3.0.13.RELEASE
CVE-2026-40478
Vulnerable Libraries - thymeleaf-spring5-3.0.11.RELEASE.jar, thymeleaf-3.0.11.RELEASE.jar
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.051%
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.4.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.4.RELEASE,org.thymeleaf:thymeleaf:3.1.4.RELEASE
CVE-2026-40477
Vulnerable Libraries - thymeleaf-3.0.11.RELEASE.jar, thymeleaf-spring5-3.0.11.RELEASE.jar
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- ❌ thymeleaf-spring5-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.051%
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution: org.thymeleaf:thymeleaf-spring5:3.1.4.RELEASE,org.thymeleaf:thymeleaf:3.1.4.RELEASE,org.thymeleaf:thymeleaf-spring6:3.1.4.RELEASE
CVE-2023-38286
Vulnerable Library - thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-2.3.5.RELEASE.jar (Root Library)
- thymeleaf-spring5-3.0.11.RELEASE.jar
- ❌ thymeleaf-3.0.11.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
Publish Date: 2023-07-14
URL: CVE-2023-38286
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.145%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7gj7-224w-vpr3
Release Date: 2023-07-14
Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Publish Date: 2021-11-09
URL: CVE-2021-43466
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 4.592%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qcj6-jqrg-4wp2
Release Date: 2021-11-09
Fix Resolution: org.thymeleaf:thymeleaf-spring5:3.0.13.RELEASE
Vulnerable Libraries - thymeleaf-spring5-3.0.11.RELEASE.jar, thymeleaf-3.0.11.RELEASE.jar
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.051%
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.4.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.4.RELEASE,org.thymeleaf:thymeleaf:3.1.4.RELEASE
Vulnerable Libraries - thymeleaf-3.0.11.RELEASE.jar, thymeleaf-spring5-3.0.11.RELEASE.jar
thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
thymeleaf-spring5-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.051%
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution: org.thymeleaf:thymeleaf-spring5:3.1.4.RELEASE,org.thymeleaf:thymeleaf:3.1.4.RELEASE,org.thymeleaf:thymeleaf-spring6:3.1.4.RELEASE
Vulnerable Library - thymeleaf-3.0.11.RELEASE.jar
Modern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: /test-app/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/thymeleaf/thymeleaf/3.0.11.RELEASE/thymeleaf-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 752b0398c84df02225991564ab382dbb91571883
Found in base branch: wip
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
Publish Date: 2023-07-14
URL: CVE-2023-38286
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.145%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7gj7-224w-vpr3
Release Date: 2023-07-14
Fix Resolution: de.codecentric:spring-boot-admin-server:3.1.2;rg.thymeleaf:thymeleaf:3.1.2.RELEASE