Template, SQL, and API boundary batch (GHSA)¶

Signal: GitHub Security Advisories Atom/REST surfaced a 2026-05-04 batch where template sandboxes, API key verification, generated API clients, cryptographic operations, and HTML rendering failed to keep untrusted syntax or state inside the intended boundary.

Advisories in this batch¶

• Thymeleaf sandbox expression bypass — org.thymeleaf:thymeleaf, thymeleaf-spring5, and thymeleaf-spring6 <= 3.1.4.RELEASE improperly recognized unauthorized syntax patterns in sandboxed expressions. References: https://github.com/advisories/GHSA-c9ph-gxww-7744, CVE-2026-41901.
• LiteLLM proxy API key SQL injection — litellm >= 1.81.16, < 1.83.7 exposed SQL injection in proxy API key verification. References: https://github.com/advisories/GHSA-r75f-5x8p-qvmc, CVE-2026-42208.
• LiteLLM /prompts/test SSTI — litellm >= 1.80.5, < 1.83.7 exposed server-side template injection in the prompt testing endpoint. References: https://github.com/advisories/GHSA-xqmj-j6mv-4862, CVE-2026-42203.
• quarkus-openapi-generator path-parameter overmatch — io.quarkiverse.openapi.generator:quarkus-openapi-generator < 2.16.0-lts and = 2.16.0 could send authentication headers to unintended operations because generated path matching was too broad. References: https://github.com/advisories/GHSA-fr8f-rwjx-f32v, CVE-2026-42333.
• Marvin timing side channel in Rust RSA — rsa <= 0.9.6 may leak key material through timing side channels. References: https://github.com/advisories/GHSA-4grx-2x9w-596c.
• Grid safe-API undefined behavior — grid >= 0.17.0, <= 1.0.0 had an integer overflow in Grid::expand_rows. References: https://github.com/advisories/GHSA-38c5-483c-4qqp, CVE-2026-42199.
• wlc API data printed as HTML — wlc < 2.0.0 printed API data with print_html without escaping. References: https://github.com/advisories/GHSA-gx2m-mcc2-r4p3, CVE-2026-42150.

Why this is durable¶

The common failure is treating a “safe” sublanguage as inert: template expressions, SQL fragments, path templates, API output, integer sizes, and cryptographic timing all become attack surfaces when they cross into stronger interpreters or observable side channels.

Immediate triage¶

1. Patch or pin away from affected ranges for Thymeleaf, LiteLLM, quarkus-openapi-generator, Rust rsa, grid, and wlc.
2. Gate exposed test/admin endpoints: disable or restrict LiteLLM prompt-testing and proxy admin APIs until patched.
3. Regenerate affected clients: rebuild Quarkus OpenAPI clients after upgrading so route matching and auth-header scoping are replaced in generated code.
4. Rotate secrets where SQLi/SSTI was reachable: treat LiteLLM proxy keys, database credentials, and prompt store secrets as potentially exposed if logs show suspicious requests.
5. Review renderer usage: locate wlc HTML output in dashboards, reports, or generated pages and check for API-controlled fields.

Hunt ideas¶

• Search LiteLLM logs for quote-heavy API key values, SQL operators, stacked query markers, Jinja-like delimiters, or /prompts/test payloads.
• Diff generated OpenAPI client route tables for overlapping path parameters that could attach auth headers to the wrong operation.
• Review Thymeleaf templates that accept partially user-controlled expressions, fragments, preprocessing markers, or utility-object access.
• Check reports generated by wlc for raw HTML tags or scriptable attributes sourced from API responses.
• Prefer constant-time crypto implementations and test for request-duration variance only in isolated lab settings.

Durable controls¶

• Treat sandboxed expression languages as code; parse with a positive grammar and deny access to reflection, class loading, process, filesystem, and network helpers.
• Parameterize SQL in every auth path; never special-case “API key lookup” as a safe string comparison shortcut.
• Scope generated-client credentials to exact operations after route matching, not before.
• Escape API data at the output sink, even if the upstream API is trusted.
• Use checked arithmetic and explicit size caps in safe APIs that can allocate or reshape buffers.

Operator lesson¶

When a boundary depends on a miniature language, test malformed syntax, overlapping routes, and output encoding first. Small interpreters fail like big ones; they just hide in “helper” code.