Trace SpEL and OGNL expression injection in Java

Jun 20, 2026 · 1 min read

Expression languages that reach reflection turn a string concat into RCE. Find the parsers and check whether any operand is user-controlled.

bash

grep -rEn "SpelExpressionParser|parseExpression|Ognl.|@Value("#{" --include=*.java .
grep -rEn "ExpressionParser|StandardEvaluationContext" --include=*.java .

A tainted expression body is the bug.

java

Expression e = parser.parseExpression(userInput); // RCE via T(java.lang.Runtime)
e.getValue();

Pro note: the safe fix is SimpleEvaluationContext, so flag any use of StandardEvaluationContext with external input. The same pattern appears in Thymeleaf preprocessing and Spring Data query annotations; grep those too.