{"id":"CVE-2026-91145","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-91145","summary":"Activiti through 7.1.0.M6 Expression Injection via Mail Task","details":"Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.","published":"2026-09-14T21:45:45.317Z","modified":"2026-09-15T11:46:52.315073742Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"PACKAGE","url":"https://github.com/Activiti/Activiti"},{"type":"ARTICLE","url":"https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-api-impl/activiti-api-process-runtime-impl/src/main/java/org/activiti/runtime/api/impl/ExpressionResolver.java"},{"type":"ARTICLE","url":"https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/bpmn/behavior/MailActivityBehavior.java"},{"type":"REPORT","url":"https://github.com/Activiti/Activiti/issues/5438"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91145.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91145"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/activiti-through-7.1.0-m6-expression-injection-via-mail-task"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T11:46:52.315073742Z"}}