Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

2026-04-29来源 Snyk BlogEnglish
Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)
CVE-2026-40478: The Thymeleaf template injection (CVSS 9.1) is conditional. Patch to 3.1.4+ immediately, and audit your code for dynamic view or template expression misuse, which is the key precondition for exploitability.

原文：https://www.a8q9.cn/en/article/don-t-panic-the-thymeleaf-template-injection-that-only-hurts-if-you-let-it-cve-2-f547e5.html

相关文章