CVE-2026-25526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25526
Aliases
Related
Published
2026-02-04T21:26:58.572Z
Modified
2026-02-06T02:37:42.836562Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Details

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

Database specific 
{
    "cwe_ids": [
        "CWE-1336"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25526.json"
}
References

Affected packages

Git / github.com/hubspot/jinjava

Affected ranges

Type
GIT
Repo
https://github.com/hubspot/jinjava
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
867dde7725b86829ad64d609d916c16d2b8b5d59

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25526.json"