What CVEs are caused by CWE-917?

44 recorded CVEs are attributed to CWE-917, including CVE-2021-26084, CVE-2022-26134, CVE-2020-17530. 6 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

What are the consequences of CWE-917?

Exploiting CWE-917 can lead to: Read Application Data, Execute Unauthorized Code or Commands.

Is CWE-917 actively exploited?

Yes. 6 CWE-917 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 44 recorded CVEs.

Base weakness

Incomplete

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Also known as: EL Injection

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Frameworks such as Java Server Page (JSP) allow a developer to insert executable expressions within otherwise-static content. When the developer is not aware of the executable nature of these expressions and/or does not disable them, then if an attacker can inject expressions, this could lead to code execution or other unexpected behaviors.

Real-world CVEs

44 recorded CVEs are caused by CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')), including 6 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 17 new CWE-917 CVEs have been recorded so far in 2026 (3 in 2025).

Showing 12 of 44 recorded CWE-917 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-917 vulnerabilities

Common consequences

What can happen when CWE-917 is exploited.

Read Application Data

Affects: Confidentiality

Execute Unauthorized Code or Commands

Affects: Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Applies to

Languages

Java

How to prevent it

Practical mitigations for CWE-917, grouped by where in the lifecycle they apply.

Architecture and Design

Avoid adding user-controlled data into an expression interpreter when possible.

Implementation

If user-controlled data must be added to an expression interpreter, one or more of the following should be performed:

Validate that the user input will not evaluate as an expression
Encode the user input in a way that ensures it is not evaluated as an expression

System Configuration

Operation

The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to "true".

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2021-44228
CISA KEV
— Product does not neutralize ${xyz} style expressions, allowing remote code execution. (log4shell vulnerability in log4j)

Terminology & mappings

Alternate terms

EL Injection

Frequently asked questions

Common questions about CWE-917.

What is CWE-917?: The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
What CVEs are caused by CWE-917?: 44 recorded CVEs are attributed to CWE-917, including CVE-2021-26084, CVE-2022-26134, CVE-2020-17530. 6 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
How do you prevent CWE-917?: Avoid adding user-controlled data into an expression interpreter when possible.
How is CWE-917 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-917?: Exploiting CWE-917 can lead to: Read Application Data, Execute Unauthorized Code or Commands.
Is CWE-917 actively exploited?: Yes. 6 CWE-917 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 44 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-917

Get alerted the moment a new CWE-917 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing