Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets

Critical sandbox bypass fixed in popular Thymeleaf Java template engine