CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement

What is CWE-917?

CWE-917 is Improper Neutralization of Special Elements used in an Expression Language Statement. The flaw arises when the product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. (Roles: Acronym, Common-Name, Attack-Focused). The database currently holds 23 vulnerabilities mapped to CWE-917 and none of them are in the CISA Known Exploited Vulnerabilities catalog.

OWASP TOP 10:2025 RANK5 — A05:2025 — Injection
Related CVES (365 days)23
AbstractionBase
Likelihood of exploit-

Vulnerabilities mapped to CWE-917

23 vulnerabilities475% increase year over year

No data

No vulnerability data in CISA KEV for CWE-917

Official definition

ByMitre CWE

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. (Roles: Acronym, Common-Name, Attack-Focused)

Frameworks such as Java Server Page (JSP) allow a developer to insert executable expressions within otherwise-static content.

Characteristics

Alternate terms

  • EL Injection
  • Expression Language Injection

Modes of introduction

  • Architecture and Design
  • Implementation

Common consequences

ImpactScopeExplanation
Read Application DataConfidentialityAn attacker could insert an expression that references private data, which is then included in the output.
Execute Unauthorized Code or CommandsIntegrityAn attacker could execute arbitrary expressions.

Risk mitigations

  1. Architecture and DesignAvoid adding user-controlled data into an expression interpreter when possible.
  2. ImplementationIf user-controlled data must be added to an expression interpreter, one or more of the following should be performed: - Validate that the user input will not evaluate as an expression - Encode the user input in a way that ensures it is not evaluated as an expression
  3. System Configuration, OperationThe framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to "true".

Detection methods

MethodApproachEffectiveness
Automated Static AnalysisAutomated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)High

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

Sources (2)
MITRE CWE
CWE Terms of Use

Supporting documents

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
More resources & insights

Explore more resources from CyStack

Website security reports

Review CyStack's security rating and practical recommendations for websites and edge assets.

Learn more

CyStack research

Explore cybersecurity research from our team of security specialists.

Learn more

Cybersecurity knowledge

Browse practical cybersecurity knowledge across CyStack's articles and guides.

Learn more