# Expression Language Injection (EL Injection)

> Detects user-controlled input evaluated by Java EL, Spring SpEL, Thymeleaf, or JSP Expression Language.

- Skill: `zakirkun/expression-language-injection-el-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/expression-language-injection-el-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/expression-language-injection-el-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/expression-language-injection-el-injection

---


# Expression Language Injection

## Overview
Expression Language (EL) injection allows attackers to execute arbitrary expressions in server-side template engines. Famous CVEs include Spring4Shell (CVE-2022-22965) and Struts RCE vulnerabilities.

Affected technologies:
- Spring SpEL: `#{T(java.lang.Runtime).getRuntime().exec('id')}`
- Thymeleaf: `__${T(java.lang.Runtime).getRuntime().exec('id')}__`
- JSP EL: `${Runtime.exec('id')}`

## Remediation
- Never pass user input to `ExpressionParser.parseExpression()`
- Use `SimpleEvaluationContext` instead of `StandardEvaluationContext`
- Disable SpEL evaluation in Thymeleaf templates when not needed