Description
Expression Language Injection (EL Injection) is a critical vulnerability that occurs when user inputs are used to construct dynamic expressions in web applications without proper validation. Attackers exploit EL Injection to modify server-side expressions, potentially extracting sensitive information or executing commands on the server.
Recommendation
To mitigate EL Injection, avoid constructing expressions directly from user inputs. If using the Spring Framework, disable double resolution functionality. Additionally, for templating engines, refrain from using user inputs to build templates.
References
Could your website be exposed too?
SmartScanner can check your website for Expression Language Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangChain serialization injection vulnerability enables secret extraction - @langchain/core - CVE-2025-68665
- Foundation Regular Expression Denial of Service vulnerability - CVE-2020-26304
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
- axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024