CVE-2026-25526NVD

Vulnerability Summary

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Severity Level

CRITICAL(9.8)

Published Date

Feb 4, 2026

Last Modified

Feb 20, 2026

Exploitation Status

????

EPSS Score (30-Day)

0.04%Probability

Root Weakness (CWE)

CWE-1336: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

External References

https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998
https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441
https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6
https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3
https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74