Back to CVE risk briefs

External risk intelligence

Thymeleaf could allow external attackers to seize control of web servers.

Thymeleaf could allow external attackers to execute malicious code, potentially compromising customer data, sensitive files, or operational systems. While no active exploitation is reported, this vulnerability requires updating software and sanitizing inputs to secure your environment.

NVD published May 12, 2026 (2 days ago)

External risk briefCRITICAL

CVE-2026-41901

Halo Surface Signal

4/ 5

Thymeleaf is a widely used Java template engine embedded in web applications. These applications are routinely deployed as public-facing web services or portals to render dynamic content, making them frequently accessible from the internet.

Exposure facts

H – Horizon Alert

A security vulnerability has been identified in the Thymeleaf server-side template engine that may allow for unauthorized code execution. Due to a flaw in how the system processes specific data inputs, security controls meant to restrict dangerous expressions can be bypassed. This type of Server-Side Template Injection could potentially allow unintended operations within the application environment if unsanitized data is processed. Consequently, this issue may impact the security and integrity of applications that rely on this technology to manage template data.

A – Asset Exposure

This vulnerability affects software applications utilizing the Thymeleaf template engine, a library commonly integrated into web-based environments. If an application uses this engine to process untrusted input, it may be susceptible to unauthorized server-side actions. When these applications are hosted on public-facing portals, this issue could compromise the integrity and confidentiality of customer data, sensitive files, or underlying operational systems.

L – Live Threat

The available context does not indicate active exploitation or observed targeting for this security bypass vulnerability. This issue involves the potential for server-side template injection if an application processes specific, unsanitized data inputs within the template engine. As there are no reports of public exploit code or active malicious activity, the current risk signals appear limited.

O – Operational Fix

To address this issue, please ensure that your development teams update to the latest available version of the affected template engine. In parallel, review existing code to ensure that all variables passed to the engine are properly sanitized, particularly when operating within restricted or sandboxed environments. Coordinating with your engineering leads to schedule these updates and reviews will effectively mitigate the potential for template injection.

References