PT-2026-6313 · Jinjava · Jinjava

Akues-An + 1 · Published 2026-02-03 · Updated 2026-03-22 · CVE-2026-25526

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JinJava versions prior to 2.7.6 JinJava versions prior to 2.8.3

Description JinJava is a Java-based template engine that uses django template syntax to render jinja templates. A flaw exists in the ForTag component that allows for arbitrary Java execution. This bypasses built-in sandbox restrictions, enabling arbitrary Java class instantiation and file access. The issue allows an attacker to circumvent security measures and potentially gain control of the system.

Recommendations Update JinJava to version 2.7.6 or later. Update JinJava to version 2.8.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

BDU:2026-01950

CVE-2026-25526

GHSA-GJX9-J8F8-7J74

Affected Products

Jinjava

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25526.json · Exploit
• https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74 · Vendor Advisory
• https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441 · Patch
• https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25526 · Security Note
• https://bdu.fstec.ru/vul/2026-01950 · Security Note
• https://osv.dev/vulnerability/GHSA-gjx9-j8f8-7j74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25526 · Vendor Advisory
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6 · Note
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3 · Note
• https://github.com/HubSpot/jinjava · Note
• https://twitter.com/0dayPublishing/status/2019164433692467258 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2035725515923853709 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2022630725888115165 · Twitter Post
• https://twitter.com/av4nth1ka/status/2022340436489273474 · Twitter Post