Read the docs
TI-2026-20635 Aliases CVE-2026-25526GHSA-gjx9-j8f8-7j74

JinJava Bypass through ForTag leads to Arbitrary Java Execution

Priority MEDIUM 51CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00966 61st percentileScored 2026-11-07
Fix Fixed jinjava (HubSpot): 2.7.6, 2.8.3com.hubspot.jinjava:jinjava (Maven): 2.8.3, 2.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HubSpotjinjavabefore 2.7.6; before 2.8.32.7.6, 2.8.3Patch availableCNA
—com.hubspot.jinjava:jinjava (Maven)2.8.0 to before 2.8.32.8.3Patch availableGHSA-gjx9-j8f8-7j74
—com.hubspot.jinjava:jinjava (Maven)before 2.7.62.7.6Patch availableGHSA-gjx9-j8f8-7j74
  • jinjava VendorHubSpot Affected before 2.7.6; before 2.8.3 Fixed in 2.7.6, 2.8.3 Patch available CNA
  • com.hubspot.jinjava:jinjava (Maven) Vendor— Affected 2.8.0 to before 2.8.3 Fixed in 2.8.3 Patch available GHSA-gjx9-j8f8-7j74
  • com.hubspot.jinjava:jinjava (Maven) Vendor— Affected before 2.7.6 Fixed in 2.7.6 Patch available GHSA-gjx9-j8f8-7j74

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*before 2.7.6; 2.8.0 to before 2.8.3VulnerableHubSpot
  • cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:* Versions before 2.7.6; 2.8.0 to before 2.8.3 Vulnerable ·HubSpot

Remediation

  • Fix · CNA jinjava (HubSpot) Fixed in 2.7.6, 2.8.3
  • Fix · GHSA-gjx9-j8f8-7j74 com.hubspot.jinjava:jinjava (Maven) Fixed in 2.8.3 Advisory →
  • Fix · GHSA-gjx9-j8f8-7j74 com.hubspot.jinjava:jinjava (Maven) Fixed in 2.7.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25526
  2. 2026-10-03 Alias added: GHSA-gjx9-j8f8-7j74

References

Patch 3

Advisory 1

Other 3

  • TI-2025-36901 jinjava Sandbox Bypass via JavaType-Based Deserialization CVSS 3.1CRITICAL 10.0
  • TI-2020-10073 Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects… CVSS 3.1MEDIUM 6.5
  • TI-2018-13389 Jinjava before 2.4.6 does not block the getClass method, related to… CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences