> For the complete documentation index, see [llms.txt](https://docs.valtimo.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.valtimo.nl/v12/release-notes/12.x.x/12.32.0.md).

# 12.32.0

## Security

* **Fixed SpEL injection vulnerability**

  `SpelExpressionProcessor`, `SpelExpressionProcessorFactory`, `QueryCondition`, and `DocumentMigrationService` evaluated user-supplied SpEL expressions using `StandardEvaluationContext`, which grants unrestricted access to Java types and methods. An authenticated user could exploit this to execute arbitrary OS commands, exfiltrate environment variables, or load arbitrary classes. These classes now use `SimpleEvaluationContext`, which only allows property access and blocks type references, constructors, and static method invocation.