CVE-2026-25526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25526", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.372Z", "datePublished": "2026-02-04T21:26:58.572Z", "dateUpdated": "2026-02-05T21:01:00.454Z"}, "containers": {"cna": {"title": "JinJava Bypass through ForTag leads to Arbitrary Java Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74"}, {"name": "https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998", "tags": ["x_refsource_MISC"], "url": "https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998"}, {"name": "https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441", "tags": ["x_refsource_MISC"], "url": "https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441"}, {"name": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6"}, {"name": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3"}], "affected": [{"vendor": "HubSpot", "product": "jinjava", "versions": [{"version": "< 2.7.6", "status": "affected"}, {"version": "< 2.8.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:26:58.572Z"}, "descriptions": [{"lang": "en", "value": "JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3."}], "source": {"advisory": "GHSA-gjx9-j8f8-7j74", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T21:00:49.634832Z", "id": "CVE-2026-25526", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T21:01:00.454Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T21:00:49.634832Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T21:00:55.395Z"}}], "cna": {"title": "JinJava Bypass through ForTag leads to Arbitrary Java Execution", "source": {"advisory": "GHSA-gjx9-j8f8-7j74", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "HubSpot", "product": "jinjava", "versions": [{"status": "affected", "version": "< 2.7.6"}, {"status": "affected", "version": "< 2.8.3"}]}], "references": [{"url": "https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74", "name": "https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998", "name": "https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441", "name": "https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6", "name": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3", "name": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:26:58.572Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25526", "state": "PUBLISHED", "dateUpdated": "2026-02-05T21:01:00.454Z", "dateReserved": "2026-02-02T19:59:47.372Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T21:26:58.572Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jinjava", "vendor": "HubSpot", "versions": [{"status": "affected", "version": "< 2.7.6"}, {"status": "affected", "version": "< 2.8.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC9EFEAD-5907-4796-A5F8-401DF7A9319A", "versionEndExcluding": "2.7.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:hubspot:jinjava:*:*:*:*:*:*:*:*", "matchCriteriaId": "959D6165-C81D-4F46-B188-E1B1BAEA5266", "versionEndExcluding": "2.8.3", "versionStartIncluding": "2.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3."}, {"lang": "es", "value": "JinJava es un motor de plantillas basado en Java, basado en la sintaxis de plantillas de Django, adaptado para renderizar plantillas Jinja. Antes de las versiones 2.7.6 y 2.8.3, JinJava es vulnerable a la ejecuci\u00f3n arbitraria de Java a trav\u00e9s de un bypass mediante ForTag. Esto permite la instanciaci\u00f3n arbitraria de clases Java y el acceso a archivos eludiendo las restricciones de sandbox integradas. Este problema ha sido parcheado en las versiones 2.7.6 y 2.8.3."}], "id": "CVE-2026-25526", "lastModified": "2026-06-17T10:24:47.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25526", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T21:00:49.634832Z", "version": "2.0.3"}}]}, "published": "2026-02-04T22:15:59.510", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:11:04.952420+00:00", "value": {"mitigation_remediation": ["Upgrade JinJava to version 2.7.6 or 2.8.3 to apply the official fix. ", "If an upgrade is infeasible, disable or remove the ForTag feature in the configuration to block the exploit path. ", "Restrict template rendering to trusted users only and audit any input that feeds into templates to ensure no malicious ForTag expressions can be injected."], "summary": {"action": "Patch", "impact": "Arbitrary Java execution via template injection"}, "threat_synthesis": {"affected_systems": "The affected product is HubSpot's JinJava template engine. All releases of JinJava older than version 2.7.6 and older than 2.8.3 are vulnerable. Administrators using these versions should verify the installed version and plan an upgrade to a patched release.", "description_and_impact": "JinJava, a Java-based template engine that emulates Django template syntax, is vulnerable to arbitrary Java execution in versions before 2.7.6 and 2.8.3. An attacker can inject malicious code through a ForTag bypass, allowing the instantiation of arbitrary Java classes and access to files, thus violating the sandboxing restrictions designed to contain template execution. This flaw corresponds to CWE\u20111336 and enables attackers to run code with the privileges of the Java process that renders the template.", "risk_and_exploitability": "The CVSS score of 9.8 categorizes the vulnerability as critical, indicating a high risk to confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low probability of exploitation in the short term, but the flaw is not listed in CISA's KEV catalog, meaning no known active exploitation campaigns are reported yet. Likely attack vectors involve an attacker who can influence the content of a template\u2014such as a user-supplied template or a template stored in a database\u2014to inject ForTag expressions that trigger arbitrary code execution. This inference is based on the description of the vulnerability, as the original data does not detail the exact exploitation method."}}}}, "created": "2026-02-05T11:39:16.948610+00:00", "updated": "2026-04-17T23:15:30.807374+00:00", "vendors": ["hubspot", "hubspot$PRODUCT$jinjava"]}