CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
- Record
CVE-2026-41883- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
EUVDEUVD-2026-28794
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
- Record
EUVD-2026-28794- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vp6r-9m58-5xv8
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
Impact
Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.
The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.
Applications using CDNResourceHandler without wildcard mappings (i.e. only explicit resource-to-URL mappings) are not affected.
Patches
Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.
Workarounds
Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
libraryName:*=https://cdn.example.com/*
with individual entries:
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
- Record
GHSA-vp6r-9m58-5xv8- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
NVD
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
- Record
CVE-2026-41883- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
OSV
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3.
- Record
CVE-2026-41883- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
OSVGHSA-vp6r-9m58-5xv8
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
Impact
Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.
The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.
Applications using CDNResourceHandler without wildcard mappings (i.e. only explicit resource-to-URL mappings) are not affected.
Patches
Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.
Workarounds
Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
libraryName:*=https://cdn.example.com/*
with individual entries:
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
- Record
GHSA-vp6r-9m58-5xv8- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-917
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.omnifaces:omnifacesMaven |
before 1.14.2 | 1.14.2 |
org.omnifaces:omnifacesMaven |
2.0-RC1 up to 2.7.32 | 2.7.32 |
org.omnifaces:omnifacesMaven |
3.0-RC1 up to 3.14.16 | 3.14.16 |
org.omnifaces:omnifacesMaven |
4.0-M1 up to 4.7.5 | 4.7.5 |
org.omnifaces:omnifacesMaven |
5.0-M1 up to 5.2.2 | 5.2.2 |
org.omnifaces:omnifacesMaven |
before 1.14.2, plus listed versions 1.11.101.10-RC11.111.11-M1 Show 21 moreShow less1.11-RC11.11-RC21.121.12.11.131.141.14.11.21.31.41.4.11.51.61.6.11.6.21.6.31.71.81.8.11.8.21.8.3 |
1.14.2 |
org.omnifaces:omnifacesMaven |
2.0-RC1 up to 2.7.32, plus listed versions 2.02.0-RC22.12.1-RC12.1-RC2 Show 45 moreShow less2.22.2-RC12.2-RC22.32.3-RC12.42.4-RC12.4-RC22.52.5-RC12.5.12.62.6-RC12.6-RC22.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.72.7.12.7.102.7.112.7.122.7.132.7.142.7.152.7.162.7.172.7.182.7.192.7.22.7.202.7.212.7.222.7.232.7.242.7.252.7.262.7.272.7.28 |
2.7.32 |
org.omnifaces:omnifacesMaven |
3.0-RC1 up to 3.14.16, plus listed versions 3.03.0-RC23.13.103.10.1 Show 38 moreShow less3.113.11.13.11.23.123.133.13.13.13.23.13.33.13.43.143.14.13.14.103.14.113.14.123.14.133.14.143.14.153.14.23.14.33.14.43.14.53.14.63.14.73.14.83.14.93.23.33.3.13.43.4.13.53.63.6.13.73.7.13.83.8.13.9 |
3.14.16 |
org.omnifaces:omnifacesMaven |
4.0-M1 up to 4.7.5, plus listed versions 4.04.0-M104.0-M114.0-M124.0-M13 Show 31 moreShow less4.0-M144.0-M154.0-M164.0-M174.0-M24.0-M34.0-M44.0-M54.0-M64.0-M74.0-M84.0-M94.0.14.14.24.34.44.4.14.54.5.14.64.6.14.6.24.6.34.6.44.6.54.74.7.14.7.24.7.34.7.4 |
4.7.5 |
org.omnifaces:omnifacesMaven |
5.0-M1 up to 5.2.3, plus listed versions 5.05.0-M25.0-M35.0-M45.0-M5 Show 5 moreShow less5.0-M65.15.25.2.15.2.2 |
5.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41883 is a high vulnerability (CVSS 8.1) in Omnifaces, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in org.omnifaces:omnifaces 1.14.2.
References
Left out here: 10 versions. The JSON record has them.