CVE-2026-25526
CRITICAL SEVERITYCVSS Score & Metrics
Base Score
9.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Description
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-1336
Source
GitHub
Vendor
maven
Product
com.hubspot.jinjava:jinjava
External References
- https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74
- https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998
- https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3
- https://github.com/advisories/GHSA-gjx9-j8f8-7j74
Discussion (0)
Add Comment
No comments yet. Be the first!