CVE-2026-25526

Critical CVSS: 9.8

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Vendor

Hubspot

Product

Jinjava

CWE

CWE-1336

Yayın Tarihi

2026-02-04 22:15:59

Güncelleme

2026-02-20 21:00:42

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-1336 Jinjava CRITICAL Hubspot 2026

Referanslar

https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74