CVE-2026-25526
published 2026-02-04CVE-2026-25526: JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.89%
54.8th percentile
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hubspot | jinjava | < 2.8.3 | 2.8.3 |
| hubspot | jinjava | < 2.7.6 | 2.7.6 |
| hubspot | jinjava | >= 2.8.0 < 2.8.3 | 2.8.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable component: com.hubspot.jinjava:jinjava versions prior to 2.7.6 and 2.8.3 are affected by sandbox bypass via ForTag, enabling arbitrary Java class instantiation and file access ↗
- ·No public exploit is confirmed as of the time of publication; EPSS exploitation probability is listed as N/A despite a 12.1 percentile score ↗
- ·Patched versions are 2.7.6 and 2.8.3; deployments using com.hubspot.jinjava:jinjava or kayenta-fips-2025.2 should be prioritized for upgrade ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
JinJava Bypass through ForTag leads to Arbitrary Java Execution
osv·2026-02-03·CVSS 9.8
CVE-2026-25526 [CRITICAL] JinJava Bypass through ForTag leads to Arbitrary Java Execution
JinJava Bypass through ForTag leads to Arbitrary Java Execution
## Impact
**Vulnerability Type**: Sandbox Bypass / Remote Code Execution
**Affected Component**: Jinjava
**Affected Users**:
- Organizations using HubSpot's Jinjava template rendering engine for user-provided template content
- Any system that renders untrusted Jinja templates using HubSpot's Jinjava implementation
- Users with the ability to create or edit custom code templates
**Severity**: **Critical** - allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions
**Root Cause**: Multiple security bypass vulnerabilities in Jinjava's sandbox mechanism:
1. **ForTag Property Access Bypass**: The `ForTag` class does not enforce `JinjavaBeanELResolver` restrictions when iterating over
GHSA
JinJava Bypass through ForTag leads to Arbitrary Java Execution
ghsa·2026-02-03·CVSS 9.8
CVE-2026-25526 [CRITICAL] CWE-1336 JinJava Bypass through ForTag leads to Arbitrary Java Execution
JinJava Bypass through ForTag leads to Arbitrary Java Execution
## Impact
**Vulnerability Type**: Sandbox Bypass / Remote Code Execution
**Affected Component**: Jinjava
**Affected Users**:
- Organizations using HubSpot's Jinjava template rendering engine for user-provided template content
- Any system that renders untrusted Jinja templates using HubSpot's Jinjava implementation
- Users with the ability to create or edit custom code templates
**Severity**: **Critical** - allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions
**Root Cause**: Multiple security bypass vulnerabilities in Jinjava's sandbox mechanism:
1. **ForTag Property Access Bypass**: The `ForTag` class does not enforce `JinjavaBeanELResolver` restrictions when iterating over
No detection rules found.
No public exploits indexed.
https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74
2026-02-04
Published