Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

Expression Language Injection vulnerabilities

CWE-917 · 12 tracked

Expression Language Injection (CWE-917) is a recognized software weakness class in the MITRE CWE catalog. The vulnerabilities below are all instances of this pattern.

How it’s exploited

How expression language injection is exploited depends on the specific vulnerability, but every CVE in this class shares the same underlying flaw pattern — which is why the same class of mitigation applies across them.

How to prevent it

Recognizing the expression language injection pattern lets you apply one class of fix across every affected component. Each CVE page below carries specific, version-level remediation.

Tracked expression language injection vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is Expression Language Injection?
Expression Language Injection (CWE-917) is a recognized software weakness class in the MITRE CWE catalog. The vulnerabilities below are all instances of this pattern.
How is expression language injection exploited?
How expression language injection is exploited depends on the specific vulnerability, but every CVE in this class shares the same underlying flaw pattern — which is why the same class of mitigation applies across them.
How do you prevent expression language injection?
Recognizing the expression language injection pattern lets you apply one class of fix across every affected component. Each CVE page below carries specific, version-level remediation.
How many expression language injection vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-917 (Expression Language Injection), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.