CWE-917— Improper Neutralization of Special Elements Used in an Expression Language Statement (EL Injection)

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.— MITRE CWE catalog

202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-917page 5 of 5

• CVE-2026-8759HIGHCVSS 7.3EG 7.3

  2026-05-17

  A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. T…

• CVE-2026-8888HIGHCVSS 7.5EG 7.5

  2026-06-03

  Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific p…