Thymeleaf

5 CVEs across 3 Thymeleaf products. Browse Thymeleaf vulnerabilities, severities, and proof-of-concept exploits.

Thymeleaf products with known CVEs

ProductCVEs
Thymeleaf5
Org.thymeleaf:thymeleaf-Spring52
Org.thymeleaf:thymeleaf-Spring62
Thymeleaf CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-41901Critical9.02026-05-12Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expr…
CVE-2026-40478Critical9.02026-04-17Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i…
CVE-2026-40477Critical9.02026-04-17Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i…
CVE-2023-38286High7.52023-07-14Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML…
CVE-2021-43466Critical9.82021-11-09In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.