CVE-2026-41901: Thymeleaf Sandbox Bypass in Expression Execution Leading to SSTI
CVE-2026-41901 affects Thymeleaf, a server-side Java template engine, prior to 3.1.5.RELEASE. The record describes a security bypass in expression execution that can enable Server-Side Template Injection when unsanitized values are used in sandboxed template contexts. The GitHub advisory rates it critical with CVSS 3.1 score 9.0, and the record states it is fixed in 3.1.5.RELEASE.
Overview
CVE-2026-41901 is a security bypass in the expression execution mechanisms of Thymeleaf, a server-side Java template engine. According to the record, Thymeleaf includes protections that avoid running potentially dangerous expressions in some sandboxed contexts, but certain constructs are not properly neutralized. The weakness is classified as CWE-917, Expression Language Injection.
Impact
The record describes the possible result as Server-Side Template Injection (SSTI). The condition requires that an application pass unsanitized variables containing such expressions to the template engine and that those values are used in sandboxed contexts inside templates. The GitHub CNA assigned CVSS 3.1 base score 9.0 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact as scored by the CNA.
Affected products and versions
The record states that the issue exists prior to 3.1.5.RELEASE of Thymeleaf. The structured affected and fixes fields in the record are empty, so the exact list of affected version ranges must be confirmed in the GitHub security advisory.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed exploitation in the wild appears in the sources consulted for this analysis. Exploitability and public exploit availability are not established by the record.
Remediation and mitigation
- Upgrade Thymeleaf to version 3.1.5.RELEASE or later, as stated in the record.
- Review applications that use Thymeleaf to identify whether any untrusted or unsanitized data is supplied to template variables used in sandboxed contexts.
- Validate and sanitize data originating from users or external systems before it reaches the template engine.
- Confirm the fixed release and any backported branches in the GitHub advisory and the NVD entry.
Detection guidance
- Inventory Thymeleaf dependencies in build files and software bills of materials, including transitive dependencies, and flag versions below 3.1.5.RELEASE.
- Review application logs for unusual template rendering errors or unexpected expression evaluation, recognizing that the record does not describe specific indicators.
- Monitor for changes in templates or in code paths that pass request-derived values into template models.
Limitations of the available information
The record does not list affected or fixed version ranges in structured form, does not include exploit exploitation data beyond EPSS, and does not provide product-specific deployment details. The NVD source status is recorded as Deferred. The EPSS probability in the record is 0.00544 with percentile 0.44153. Whether a given application is exposed depends on its template usage and data handling, which the record does not describe.
Frequently asked questions
What is CVE-2026-41901?
It is a security bypass in the expression execution mechanisms of Thymeleaf, a Java server-side template engine, affecting versions prior to 3.1.5.RELEASE. The record says it can lead to Server-Side Template Injection under specific conditions.
What version fixes the issue?
The record states that the vulnerability is fixed in 3.1.5.RELEASE. The structured fixes field is empty, so confirm details in the GitHub advisory.
Is this vulnerability being actively exploited?
The CISA KEV entry is not listed in the record, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.