PT-2026-6313 · Jinjava · Jinjava

Akues-An + 1 · Publicado 2026-02-03 · Atualizado 2026-03-22 · CVE-2026-25526

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JinJava versions prior to 2.7.6 JinJava versions prior to 2.8.3

Description JinJava is a Java-based template engine that uses django template syntax to render jinja templates. A flaw exists in the ForTag component that allows for arbitrary Java execution. This bypasses built-in sandbox restrictions, enabling arbitrary Java class instantiation and file access. The issue allows an attacker to circumvent security measures and potentially gain control of the system.

Recommendations Update JinJava to version 2.7.6 or later. Update JinJava to version 2.8.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

BDU:2026-01950

CVE-2026-25526

GHSA-GJX9-J8F8-7J74

Produtos afetados

Jinjava

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25526.json · Exploit
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 · Nota
• https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 · Aviso do Fabricante
• https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 · Correção
• https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 · Correção
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 · Nota
• https://github.com/HubSpot/jinjava · Nota
• https://twitter.com/0dayPublishing/status/2019164433692467258 · Publicação no Twitter
• https://twitter.com/TheRabbitPy/status/2035725515923853709 · Publicação no Twitter
• https://twitter.com/UndercodeUpdate/status/2022630725888115165 · Publicação no Twitter
• https://twitter.com/av4nth1ka/status/2022340436489273474 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2019424595649130783 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25526 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2019353165158629514 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-01950 · Nota de Segurança