Tag

thymeleaf

Safeguard articles tagged "thymeleaf" — guides, analysis, and best practices for software supply chain and application security.

1 article

Thymeleaf SSTI risk patterns: how a tab character bypassed a Java template sandbox

CVE-2026-40478 shows how a single tab character bypassed Thymeleaf's expression sandbox, turning misused templates into remote code execution.