CVEvulnerability
CVE-2026-25526
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1336
Description
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
Affected configurations
• hubspot jinjava (< 2.7.6)
• hubspot jinjava (>= 2.8.0 < 2.8.3)
Related
Weakness · CWE (1)
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
References
- https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 Patch
- https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 Patch
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 Product, Release Notes
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 Product, Release Notes
- https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 Patch, Vendor Advisory