Thymeleaf, a Java template engine, does not fully neutralize certain syntax patterns that can lead to the execution of unauthorized expressions. When an application developer passes unchecked user input directly into the template engine, an unauthenticated attacker can inject malicious expressions and obtain Server‑Side Template Injection (SSTI). This falls under the CWE-1336 and CWE-917 weaknesses and allows the attacker to run code with the privileges of the server process.

All versions of Thymeleaf up to and including 3.1.3.RELEASE are vulnerable, including the core library and its Spring 5 and Spring 6 bindings (thymeleaf-spring5 and thymeleaf-spring6). The vulnerability was fixed in Thymeleaf 3.1.4.RELEASE; any deployment using older releases must update or apply a mitigation.

The CVSS score of 9.1 indicates a critical severity with network‑based attack and unauthenticated exploitation. No EPSS data is available, implying that the current exploitation probability is not quantified. The vulnerability is not listed in CISA’s KEV catalog, but the high CVSS rating warrants immediate attention. The likely attack vector involves a malicious payload embedded in web request data that is rendered by the template engine, enabling remote code execution. Without remediation, attackers can read or modify server data and compromise the entire application.