GHSA-gjx9-j8f8-7j74
Critical · 9.8CVSS
9.8
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.hubspot.jinjava:jinjava | 0 | 2.7.6 |
| Maven | com.hubspot.jinjava:jinjava | 2.8.0 | 2.8.3 |
| Chainguard | kayenta-2025.0 | 0 | 2025.0.8-r6 |
| Chainguard | kayenta-2025.1 | 0 | 2025.1.6-r4 |
| Chainguard | kayenta-2025.2 | 0 | 2025.2.3-r3 |
| Chainguard | kayenta-fips-2025.0 | 0 | 2025.0.8-r7 |
| Chainguard | kayenta-fips-2025.1 | 0 | 2025.1.6-r3 |
| Chainguard | kayenta-fips-2025.2 | 0 | 2025.2.3-r3 |
Related vulnerabilities
- CVE-2026-25526 JinJava is a Java-based template engine based on django template syntax, adapted to… Same vulnerability
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects kayenta-2025.0
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects kayenta-2025.0
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects kayenta-2025.0
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects kayenta-2025.0
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects kayenta-2025.0
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects kayenta-2025.0
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects kayenta-2025.0