CVE-2026-40477 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-917** (Improper Neutralization of Special Elements in Dynamic Code). ❌ **Flaw**: The engine fails to correctly restrict the scope of accessible objects during expression evaluation.

Q: Who is affected? (Versions/Components)

📦 **Affected**: **Thymeleaf** (Java Template Engine). 📅 **Versions**: **3.1.3.RELEASE** and all earlier versions. 🏢 **Vendor**: thymeleaf.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** public PoC/Exploit listed in the data. 🔍 **Status**: References point to GitHub Security Advisory (**GHSA-r4v4-5mwr-2fwr**), but no active wild exploitation confirmed yet.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1️⃣ Scan for **Thymeleaf** dependencies in Java projects. 2️⃣ Verify version is **< 3.1.3.RELEASE**. 3️⃣ Look for dynamic template rendering using user-controlled input.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. 🔗 **Reference**: GitHub Security Advisory **GHSA-r4v4-5mwr-2fwr**. 💡 **Action**: Upgrade to a patched version immediately.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. 📊 **CVSS**: High impact on Confidentiality, Integrity, and Availability. ⚡ **Priority**: **Immediate** patching required for all production systems using vulnerable versions.

Updated May 06, 2026 CVSS 9.1 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Thymeleaf template engine has a **Security Bypass** flaw in its expression execution mechanism.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-917** (Improper Neutralization of Special Elements in Dynamic Code). <br>❌ **Flaw**: The engine fails to correctly restrict the scope of accessible objects during expression evaluation.

Q3Who is affected? (Versions/Components)

📦 **Affected**: **Thymeleaf** (Java Template Engine). <br>📅 **Versions**: **3.1.3.RELEASE** and all earlier versions. <br>🏢 **Vendor**: thymeleaf.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: <br>1️⃣ **Execute Arbitrary Code** on the server. <br>2️⃣ **Read/Sensitive Data** (High Confidentiality). <br>3️⃣ **Modify System State** (High Integrity).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold**: **Low**. <br>✅ **Auth**: None required (**PR:N**). <br>✅ **Network**: Remote (**AV:N**). <br>✅ **UI**: No user interaction needed (**UI:N**).…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** public PoC/Exploit listed in the data. <br>🔍 **Status**: References point to GitHub Security Advisory (**GHSA-r4v4-5mwr-2fwr**), but no active wild exploitation confirmed yet.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1️⃣ Scan for **Thymeleaf** dependencies in Java projects. <br>2️⃣ Verify version is **< 3.1.3.RELEASE**. <br>3️⃣ Look for dynamic template rendering using user-controlled input.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **Yes**. <br>🔗 **Reference**: GitHub Security Advisory **GHSA-r4v4-5mwr-2fwr**. <br>💡 **Action**: Upgrade to a patched version immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1️⃣ **Strict Input Validation**: Sanitize all user inputs before template processing. <br>2️⃣ **Disable Expressions**: Restrict or disable dynamic expression evaluation where possible.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>📊 **CVSS**: High impact on Confidentiality, Integrity, and Availability. <br>⚡ **Priority**: **Immediate** patching required for all production systems using vulnerable versions.

Continue exploring

Vulnerability detail Full AI analysis (login) thymeleaf CWE-917