CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Parent: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

206 vulnerabilities with CWE-917
CVE-2026-52439 CRITICAL
Beetl 3.20.2 - Remote Code Execution via Type.New Function and Property Reflection
CVSS 9.8
CVE-2026-65591 HIGH
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
CVSS 8.8
CVE-2026-57281 HIGH
Jenkins Script Security Plugin < 1402.v94c9ce464861 - Protection Mechanism Failure
CVSS 7.5
CVE-2026-11561 CRITICAL
SSTI in Soagen Informatics' Apinizer
CVSS 9.8
CVE-2026-40985 MEDIUM
Spring Web Flow 2.5.0-2.5.1, 3.0.0-3.0.1, 4.0.0 - Unified EL Injection
CVSS 6.4
CVE-2026-41729 HIGH
Spring Data REST SpEL Injection via Map Key in JSON Patch
CVSS 8.1
CVE-2026-41719 MEDIUM
Spring Data KeyValue and Redis - SpEL Injection in SpelPropertyComparator
CVSS 6.4
CVE-2026-41717 HIGH
Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
CVSS 8.1
CVE-2026-8888 HIGH
Securly Chrome Extension < 3.0.7 - Denial of Service
CVSS 7.5
CVE-2026-44209 HIGH
Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI
CVSS 7.5
CVE-2026-2587 CRITICAL
Eclipse Glassfish - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 9.6
CVE-2026-2586 CRITICAL
Eclipse Glassfish - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 9.1
CVE-2026-31380 MEDIUM
Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
CVSS 6.5
CVE-2026-26462 HIGH
Offline Hospital Management System 5.3.0 - Remote Code Execution
CVSS 7.3
CVE-2026-8759 HIGH
xiandafu beetl SpELFunction SpELFunction.java expression language injection
CVSS 7.3
CVE-2026-41901 CRITICAL
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
CVSS 9.0
CVE-2026-41705 HIGH
Spring AI - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 8.6
CVE-2026-41883 HIGH
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
CVSS 8.1
CVE-2026-28201 HIGH
SurrealDB Injection on Open Notebook
CVSS 7.8
CVE-2026-42811 CRITICAL
Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
CVSS 9.9
CVE-2026-40897 HIGH
mathjs 13.1.1-15.1.9 - Remote Code Execution via Expression Parser
CVSS 8.8
CVE-2026-40478 CRITICAL
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
CVSS 9.0
CVE-2026-40477 CRITICAL
Improper restriction of the scope of accessible objects in Thymeleaf expressions
CVSS 9.0
CVE-2026-39842 CRITICAL
OpenRemote is Vulnerable to Expression Injection
CVSS 9.9
CVE-2026-34714 CRITICAL
Vim < 9.2.0272 - Remote Code Execution via %{expr} Injection in Tabpanel
CVSS 9.2
Details
Vulnerabilities 206