# CVE-2026-25526: JinJava Bypass through ForTag leads to Arbitrary Java Execution

> CVE-2026-25526: JinJava Bypass through ForTag leads to Arbitrary Java Execution. CVSS 9.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-25526
Last updated: 2026-06-17T10:24:47Z

- Published: 2026-02-04 21:26 UTC · Updated: 2026-06-17 10:24 UTC · Assigner: GitHub\_M
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.98%, 62th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1336

## Description

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

## Affected vendors and products

- HubSpot: jinjava

## Tracked companies

- [HubSpot](https://rewindex.com/company/hubspot.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-25526)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-25526)
- [https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998](https://github.com/HubSpot/jinjava/commit/3d02e504d8bbb13bf3fe019e9ca7b51dfce7a998)
- [https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441](https://github.com/HubSpot/jinjava/commit/c7328dce6030ac718f88974196035edafef24441)
- [https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6](https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.7.6)
- [https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3](https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.3)
- [https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74](https://github.com/HubSpot/jinjava/security/advisories/GHSA-gjx9-j8f8-7j74)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-25526 · Markdown: https://rewindex.com/cve/CVE-2026-25526.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-25526 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:27.997Z