Skip to content

[Aikido] Fix critical issue in thymeleaf via minor version upgrade from 3.1.2 to 3.1.4#3

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-23482417-tjz1
Open

[Aikido] Fix critical issue in thymeleaf via minor version upgrade from 3.1.2 to 3.1.4#3
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-23482417-tjz1

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade Thymeleaf to fix critical Server-Side Template Injection (SSTI) vulnerabilities allowing unauthorized expression execution and sensitive object access.

⚠️ Breaking changes analysis not available for: org.thymeleaf:thymeleaf

✅ 2 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-40478
🚨 CRITICAL
[thymeleaf] Expression injection bypass in template processing allows unauthenticated attackers to execute unauthorized expressions via Server-Side Template Injection (SSTI) when unvalidated user input is passed to the template engine.
CVE-2026-40477
🚨 CRITICAL
[thymeleaf] A security bypass vulnerability allows Server-Side Template Injection (SSTI) attacks when unvalidated user input is passed to templates, as the library fails to properly restrict access to sensitive objects within expression execution mechanisms.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants