Read the docs
TI-2025-36901 Aliases CVE-2025-59340GHSA-m49c-g9wr-hv6v

jinjava Sandbox Bypass via JavaType-Based Deserialization

Priority MEDIUM 53CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02185 82nd percentileScored 2026-11-07
Fix Fixed jinjava (HubSpot): 2.8.1com.hubspot.jinjava:jinjava (Maven): 2.8.1, 2.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HubSpotjinjavabefore 2.8.12.8.1Patch availableCNA
—com.hubspot.jinjava:jinjava (Maven)2.8.0 to before 2.8.12.8.1Patch availableGHSA-m49c-g9wr-hv6v
—com.hubspot.jinjava:jinjava (Maven)2.7.0 to before 2.7.52.7.5Patch availableGHSA-m49c-g9wr-hv6v
  • jinjava VendorHubSpot Affected before 2.8.1 Fixed in 2.8.1 Patch available CNA
  • com.hubspot.jinjava:jinjava (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-m49c-g9wr-hv6v
  • com.hubspot.jinjava:jinjava (Maven) Vendor— Affected 2.7.0 to before 2.7.5 Fixed in 2.7.5 Patch available GHSA-m49c-g9wr-hv6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*before 2.8.1VulnerableHubSpot
  • cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:* Versions before 2.8.1 Vulnerable ·HubSpot

Remediation

  • Fix · CNA jinjava (HubSpot) Fixed in 2.8.1
  • Fix · GHSA-m49c-g9wr-hv6v com.hubspot.jinjava:jinjava (Maven) Fixed in 2.8.1 Advisory →
  • Fix · GHSA-m49c-g9wr-hv6v com.hubspot.jinjava:jinjava (Maven) Fixed in 2.7.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59340
  2. 2026-10-03 Alias added: GHSA-m49c-g9wr-hv6v

References

Patch 1

Advisory 2

Other 4

  • TI-2026-20635 JinJava Bypass through ForTag leads to Arbitrary Java Execution CVSS 3.1CRITICAL 9.8
  • TI-2020-10073 Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects… CVSS 3.1MEDIUM 6.5
  • TI-2018-13389 Jinjava before 2.4.6 does not block the getClass method, related to… CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences