Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.

Specifically, an application is vulnerable when all of the following conditions are met:

• The application evaluates SpEL expressions using SimpleEvaluationContext.
• The SpEL expression compiler is active, either because the spring.expression.compiler.mode system property or Spring property has been set to IMMEDIATE or MIXED, or because a SpelParserConfiguration with SpelCompilerMode set to IMMEDIATE or MIXED was used to create the SpelExpressionParser.

When all conditions are met, the SpEL compiler can silently compile expressions evaluated within a SimpleEvaluationContext, causing subsequent evaluations to bypass all safety guards that are enforced during interpreted evaluation. The compiler may also cause unbounded class-loading growth, as each distinct compilable expression results in a new class being generated and loaded into a child ClassLoader.