CVE-2026-25526
Critical · 9.8CVSS
9.8
EPSS
1.0%
Published
Feb 4, 2026
CISA due date
—
The record
JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.hubspot.jinjava:jinjava | 0 | 2.7.6 |
| Maven | com.hubspot.jinjava:jinjava | 2.8.0 | 2.8.3 |
| Chainguard | kayenta-2025.0 | 0 | 2025.0.8-r6 |
| Chainguard | kayenta-2025.1 | 0 | 2025.1.6-r4 |
| Chainguard | kayenta-2025.2 | 0 | 2025.2.3-r3 |
| Chainguard | kayenta-fips-2025.0 | 0 | 2025.0.8-r7 |
| Chainguard | kayenta-fips-2025.1 | 0 | 2025.1.6-r3 |
| Chainguard | kayenta-fips-2025.2 | 0 | 2025.2.3-r3 |
Related vulnerabilities
- GHSA-gjx9-j8f8-7j74 JinJava Bypass through ForTag leads to Arbitrary Java Execution Same vulnerability
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects kayenta-2025.0
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects kayenta-2025.0
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects kayenta-2025.0
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects kayenta-2025.0
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects kayenta-2025.0
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects kayenta-2025.0
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects kayenta-2025.0