Xiandafu Beetl vulnerabilities

CVE-2024-22533 [CRITICAL] CWE-94 CVE-2024-22533: Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerabil Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

CVE-2026-8759 [HIGH] CWE-20 CVE-2026-8759: A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of th A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote