CVE-2026-25526
Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.91% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1336
- Affected
- hubspot/jinjava
- Source
- security-advisories@github.com
References
- https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998Patch
- https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441Patch
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6Product, Release Notes
- https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3Product, Release Notes
- https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.