CVE-2026-25526

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25526
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 Patch
https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 Patch
https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 Product Release Notes
https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 Product Release Notes
https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*
cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*
History

20 Feb 2026, 21:00

Type Values Removed Values Added
Summary
  • (es) JinJava es un motor de plantillas basado en Java, basado en la sintaxis de plantillas de Django, adaptado para renderizar plantillas Jinja. Antes de las versiones 2.7.6 y 2.8.3, JinJava es vulnerable a la ejecución arbitraria de Java a través de un bypass mediante ForTag. Esto permite la instanciación arbitraria de clases Java y el acceso a archivos eludiendo las restricciones de sandbox integradas. Este problema ha sido parcheado en las versiones 2.7.6 y 2.8.3.
CPE cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*
First Time Hubspot
Hubspot jinjava
References () https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 - () https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 - Patch
References () https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 - () https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 - Patch
References () https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 - () https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 - Product, Release Notes
References () https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 - () https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 - Product, Release Notes
References () https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 - () https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 - Patch, Vendor Advisory

04 Feb 2026, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 22:15

Updated : 2026-02-20 21:00

NVD link : CVE-2026-25526

Mitre link : CVE-2026-25526

CVE.ORG link : CVE-2026-25526

JSON object : View

Products Affected

hubspot

  • jinjava
CWE
CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine