CWE-917: EL Injection
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Also known as Improper Neutralization of Special Elements used in an Expression Language Statement, Expression Language Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation ofbiz Apache OFBiz: Unsandboxed Groovy compiled from a service parameter 8.8 High
- apache camel Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions 5.4 Medium
- camunda 7 Camunda Expression Injection via orQueries RCE 9.3 Critical
- apache software foundation camel Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages 8.8 High
- red hat connectivity link 1, connectivity link 1.4, connectivity link 1.5 +1 more +3 more Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway po… 7.4 High
- apache struts Apache Struts: OGNL injection in the legacy RESTful action mapper 9.8 Critical
- apache wss4j Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. 9.1 Critical
- activiti Activiti through 7.1.0.M6 Expression Injection via Mail Task 7.1 High
- No product listed An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type... 9.8 Critical
- n8n n8n before 1.123.64 Sanitizer Bypass Remote Code Execution 8.9 High
- jenkins script security, jenkins project script security plugin, red hat openshift developer tools and services +11 more +13 more Jenkins Script Security Plugin has a script security bypass vulnerability 7.5 High
- soagen informatics technologies software and consulting inc. apinizer SSTI in Soagen Informatics' Apinizer 9.8 Critical
- broadcom spring web flow, spring web flow +1 more Data Binding Vulnerability in Spring Web Flow with Unified EL Parser 6.4 Medium
- spring data rest, vmware spring data rest +1 more Spring Data REST SpEL Injection via Map Key in JSON Patch 8.1 High
- broadcom spring data keyvalue, spring data redis, spring data keyvalue +1 more +3 more Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator 6.4 Medium
- spring data mongodb, vmware spring data mongodb +1 more Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding 8.1 High
- securly, securly chrome extension +1 more CVE-2026-8888 7.5 High
-
github.com/caddyserver/caddy/v2Go Caddy CVE-2026-30852 Fix Bypass 5.5 Medium - eclipse glassfish GlassFish's Administration Console is Vulnerable to RCE 9.1 Critical
- eclipse glassfish GlassFish's gadget handler is vulnerable to RCE 9.6 Critical
- apache ofbiz Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass 6.5 Medium
- No product listed Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron... 7.3 High
- xiandafu beetl xiandafu beetl SpELFunction SpELFunction.java expression language injection 6.9 Medium
- spring ai, vmware spring ai +1 more Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs 8.6 High
- masci banks, red hat exploit intelligence, openshift lightspeed +1 more +3 more Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI 7.5 High
- open notebook notebook, lfnovo open-notebook +1 more SurrealDB Injection on Open Notebook 8.7 High
- thymeleaf Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions 9.0 Critical
- apache polaris Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions 9.4 Critical
- josdejong mathjs, red hat developer hub, enterprise linux 10 +5 more +7 more Math.js: Unsafe object property setter in mathjs 8.8 High
- omnifaces OmniFaces: EL injection via crafted resource name in wildcard CDN mapping 8.1 High
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 more Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf 9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 more Improper restriction of the scope of accessible objects in Thymeleaf expressions 9.1 Critical
- openremote OpenRemote is Vulnerable to Expression Injection 10.0 Critical
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 more Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in... 9.2 Critical
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 more Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 8.1 High
- spring ai, vmware spring ai +1 more SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution 9.8 Critical
- traefik, red hat openshift dev spaces 3.27 +1 more Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass 6.3 Medium
- capricorn86 happy-dom, happy dom, red hat ansible automation platform 2 +1 more +3 more Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code 8.8 High
- vmware spring ai CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter 8.6 High
- apache iotdb Apache IoTDB: JEXL Expression Injection Vulnerability 9.8 Critical
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 more jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution 8.1 High
- the wikimedia foundation mediawiki - discussiontools extension DiscussionTools should use better regex 8.8 High
- vmware spring cloud gateway server webflux Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables 7.5 High
- hutool Hutool allows remote code execution (RCE) via the QLExpressEngine class 6.5 Medium
- spring cloud gateway Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux 10.0 Critical
- b. braun melsungen ag onlinesuite Improper Neutralization of Special Elements in OnlineSuite 10.0 Critical
- ibm cognos analytics IBM Cognos Analytics expression language injection 9.0 Critical
- qos.ch sarl logback-core JaninoEventEvaluator vulnerability 5.9 Medium
- papercut mf, ng +1 more Reflected XSS in PaperCut MF 6.3 Medium
- datagear DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection 5.3 Medium
- Show olderLoading…