CVE-2026-25526

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine pada hubspot jinjava. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 patch · advisory vendor
• https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 patch
• https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 patch
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 product · release notes
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 product · release notes