Skip to content

Product

HubSpot jinjava vulnerabilities

4 published CVES affecting HubSpot jinjava, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
2
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest HubSpot jinjava CVEs

Newest publication first

  1. CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution

    Published
    CriticalCVSS 9.8

    JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file acce...

  2. CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization

    Published
    CriticalCVSS 9.8

    jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input...

  3. CVE-2020-12668 Unauthorized access to Class instance in Jinjava

    Published
    MediumCVSS 6.5 EPSS 1.8%

    Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

  4. CVE-2018-18893 Jinjava calls getClass

    Published
    MediumCVSS 5.3 EPSS 1.8%

    Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.