Skip to content
OpenAdvisories

Package · Maven

com.hubspot.jinjava:jinjava

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.8
    CVE-2026-25526 Public exploit

    JinJava Bypass through ForTag leads to Arbitrary Java Execution

    JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instan…

    HubSpot jinjava com.hubspot.jinjava:jinjava Maven
  • Critical 9.8
    CVE-2025-59340

    jinjava Sandbox Bypass via JavaType-Based Deserialization

    jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attac…

    HubSpot jinjava com.hubspot.jinjava:jinjava Maven
  • Medium 6.5
    CVE-2020-12668

    Unauthorized access to Class instance in Jinjava

    Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

    com.hubspot.jinjava:jinjava Maven
  • Medium 5.3
    CVE-2018-18893 Public exploit

    Jinjava calls getClass

    Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

    com.hubspot.jinjava:jinjava Maven