Maven package
com.hubspot.jinjava/jinjava
pkg:maven/com.hubspot.jinjava/jinjava
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25526 | — | >= 2.8.0, < 2.8.3 | 2.8.3 | Feb 4, 2026 | JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file acce | ||
| CVE-2025-59340 | — | >= 2.8.0, < 2.8.1 | 2.8.1 | Sep 17, 2025 | jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input | ||
| CVE-2020-12668 | — | < 2.5.4 | 2.5.4 | Feb 19, 2021 | Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure. | ||
| CVE-2018-18893 | — | < 2.4.6 | 2.4.6 | Jan 3, 2019 | Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java. |
- CVE-2026-25526Feb 4, 2026affected >= 2.8.0, < 2.8.3fixed 2.8.3
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file acce
- CVE-2025-59340Sep 17, 2025affected >= 2.8.0, < 2.8.1fixed 2.8.1
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input
- CVE-2020-12668Feb 19, 2021affected < 2.5.4fixed 2.5.4
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
- CVE-2018-18893Jan 3, 2019affected < 2.4.6fixed 2.4.6
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.