Back to overview

CVE-2026-25526

CRITICAL
9.8
CVSS 3.1
Description
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Metadata

CVE ID
CVE-2026-25526
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-02-02 19:59 UTC
Published
2026-02-04 21:26 UTC
Last updated
2026-02-05 21:01 UTC
Primary CWE
CWE-1336
CWE-1336: Improper Neutralization of Special Elements Used i…
Vendor / Product
HubSpot / jinjava
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
HubSpot jinjava — < 2.7.6, < 2.8.3
Weakness (CWE)
CWESourceDescription
CWE-1336 cna CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (5)
Back to overview