by Kastro
Paper/Archive/CVE-2026-25526

CVE-2026-25526

HubSpot jinjava — JinJava Bypass through ForTag leads to Arbitrary Java Execution

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.7.617 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Affected

ProductAffectedFixed inSource
jinjava< 2.7.6–CNA
jinjava< 2.8.3–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74refgithub.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998refgithub.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441refgithub.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6refgithub.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3