jinjava vulnerabilities

2 known vulnerabilities in jinjava from HubSpot. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  jinjava: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-25526Feb 4, 2026HubSpot

  JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instant

• 10.0 Critical severity

  jinjava: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2025-59340Sep 17, 2025HubSpotEPSS 2.19%

  jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attack