CVE-2026-59283

Affected versions of the `org.springframework:spring-expression` package are vulnerable to Improper Control of Dynamically-Managed Code Resources due to a safety guard bypass. The `SimpleEvaluationContext`, intended to restrict the capabilities of Spring Expression Language (SpEL), is not honoured when an expression is compiled, allowing the compiled code to bypass the restrictions enforced during interpreted evaluation. An attacker can exploit this by supplying an expression or fragment that, once compiled, accesses types and methods that should be restricted, potentially leading to unauthorized code execution.