PT-2025-38270 · Jinjava · Jinjava

Taisehub · Published 2025-09-16 · Updated 2025-10-15 · CVE-2025-59340

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jinjava versions prior to 2.8.1

Description jinjava is a Java-based template engine. A sandbox escape flaw exists due to unrestricted interaction with the properties of JinjavaInterpreter instances, specifically through the ObjectMapper. By utilizing mapper.getTypeFactory().constructFromCanonical(), an attacker can deserialize attacker-controlled input into arbitrary classes, bypassing sandbox restrictions. This allows instantiation of classes like java.net.URL, enabling access to local files and URLs. With further exploitation, this can potentially lead to remote code execution (RCE). Over 289,100 instances are potentially exposed. The vulnerability allows escaping the sandbox and creating powerful primitives for file access and potentially RCE. The issue involves traversing from the int3rpr3t3r variable to the config field, which exposes an ObjectMapper. The JavaType class is not restricted, allowing attackers to leverage constructFromCanonical to instantiate semi-arbitrary classes.

Recommendations Update to version 2.8.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

BDU:2026-00217

CVE-2025-59340

GHSA-M49C-G9WR-HV6V

Affected Products

Jinjava

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59340.json · Exploit
• https://github.com/HubSpot/jinjava/commit/66df351e7e8ad71ca04dcacb4b65782af820b8b1 · Patch
• https://github.com/HubSpot/jinjava/security/advisories/GHSA-m49c-g9wr-hv6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59340 · Security Note
• https://osv.dev/vulnerability/GHSA-m49c-g9wr-hv6v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00217 · Security Note
• https://github.com/HubSpot/jinjava · Note
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.1 · Note
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.5 · Note
• https://t.me/netlas/477 · Telegram Post
• https://twitter.com/Cloudforce_One/status/1977816608933335198 · Twitter Post
• https://twitter.com/CFchangelog/status/1978536603841962494 · Twitter Post
• https://twitter.com/CCBalert/status/1969044245127331999 · Twitter Post
• https://twitter.com/CveFindCom/status/1968414469496644016 · Twitter Post