High vulnerability issue 'thymeleaf-spring5' dependency JAR

• Version of Thymeleaf : thymeleaf-spring5-3.0.12.RELEASE.jar
• Environment: Spring Boot - 2.5.5
• Detailed steps to reproduce your issue: Veracode ‘Software Composition Analysis’ finds below given High vulnerability issue in all versions of ‘thymeleaf-spring5’ dependency Jars.
• Any possible workarounds you may have found - No

High Severity CVE-2021-43466 Template Injection: thymeleaf-spring5 is vulnerable to template injection. An attacker can inject malicious input through the render function in AjaxThymeleafView.java, leading to remote code execution.

Can you please look into it ?

[danielfernandez]

Just in order to reduce anxiety around this issue, I’d like to explain that CVE-2021-43466 only affects those applications that contain controllers or controller configurations that take a request parameter and directly use it, without previous filtering, as the name of the view to be rendered — which is something IMHO no one should be doing, as it is a bit like voluntarily providing a way for code injection.

This is actually just a border case that was not covered by the overall fix for this scenario that was included in 3.0.12.

Current 3.0.13-SNAPSHOT already contains a fix, and 3.0.13 will be released very soon.

[torsten-sap]

@danielfernandez Do you have a rough estimation when version 3.0.13 with the fix will be available? Thanks!