Weaknesses of type CWE-917

60 results

Injeção de linguagem de expressão

Ocorre quando uma aplicação constrói expressões dinâmicas (como EL em JSP, SpEL em Spring, OGNL em frameworks Java) sem sanitizar entrada do usuário. Um atacante injeta código nessas expressões, que é interpretado e executado no servidor, permitindo acesso a objetos, métodos e variáveis sensíveis da aplicação.

Example

Uma página JSP concatena nome do usuário direto em uma expressão EL como ${param.user}, ou um formulário Spring usa SpEL para filtros dinâmicos. Um atacante envia ${T(java.lang.Runtime).getRuntime().exec('cmd')} como entrada e obtém execução de comando no servidor.

How to mitigate

Nunca concatene entrada de usuário em expressões dinâmicas. Use templates com escapeamento automático, valide e sanitize entrada contra padrões whitelist, ou use APIs de binding seguro (como binding paramétrico) ao invés de construir expressões em string. Desabilite EL ou SpEL quando não forem necessários.

CVE-2026-40477CRITICALImproper restriction of the scope of accessible objects in Thymeleaf expressionsEPSS 0.9%CVE-2026-2586CRITICALAn authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the pEPSS 0.8%CVE-2026-33943HIGHHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2025-3322CRITICALImproper Neutralization of Special Elements in OnlineSuiteEPSS 0.6%CVE-2026-2587CRITICALA critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gaEPSS 0.6%CVE-2024-51466CRITICALIBM Cognos Analytics expression language injectionEPSS 0.6%CVE-2024-7552MEDIUMDataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injectionEPSS 0.6%CVE-2026-34714CRITICALVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr}EPSS 0.6%CVE-2026-40897HIGHMath.js: Unsafe object property setter in mathjsEPSS 0.6%CVE-2026-24737HIGHjsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionEPSS 0.5%CVE-2026-22729HIGHCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterEPSS 0.5%CVE-2022-4146HIGHEL Injection Vulnerability in Hitachi Replication ManagerEPSS 0.5%CVE-2026-52439CRITICALAn issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mEPSS 0.5%CVE-2022-23504MEDIUMTYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationEPSS 0.5%CVE-2026-41883HIGHOmniFaces: EL injection via crafted resource name in wildcard CDN mappingEPSS 0.5%CVE-2026-31380MEDIUMApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization BypassEPSS 0.5%CVE-2026-65591HIGHn8n before 1.123.64 Sanitizer Bypass Remote Code ExecutionEPSS 0.5%CVE-2025-41253HIGHSpring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment VariablesEPSS 0.5%CVE-2026-32695MEDIUMTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassEPSS 0.5%