MavenPackage

com.hubspot.jinjava:jinjava

4 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-25526
Affects 1.0.0 to 2.7.5 (2.7.6 is outside it); 2.8.0 to 2.8.2 (2.8.3 is outside it)
CVE-2025-59340
Affects 2.7.0 to 2.7.4 (2.7.5 is outside it); 2.8.0 (2.8.1 is outside it)
CVE-2020-12668
Affects 1.0.0 to 2.5.3 (2.5.4 is outside it)
CVE-2018-18893
Affects 1.0.0 to 2.4.5 (2.4.6 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-25526Critical 9.8
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Affected: from 2.8.0, fixed in 2.8.3; fixed in 2.7.6.
Fixed in 2.7.6 (released Feb 2, 2026, 2 days before disclosure) and 2.8.3 (released Feb 2, 2026, 2 days before disclosure).
The latest release, 2.8.5, is not affected.
CVE-2025-59340Critical 9.8
jinjava Sandbox Bypass via JavaType-Based Deserialization
Affected: from 2.8.0, fixed in 2.8.1; from 2.7.0, fixed in 2.7.5.
Fixed in 2.7.5 (released Sep 29, 2025, 12 days after disclosure) and 2.8.1 (released Sep 16, 2025, 1 day before disclosure).
The latest release, 2.8.5, is not affected.
CVE-2020-12668Unrated
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.
Affected: fixed in 2.5.4.
Fixed in 2.5.4 (released May 4, 2020, 291 days before disclosure).
The latest release, 2.8.5, is not affected.
CVE-2018-18893Unrated
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
Affected: fixed in 2.4.6.
Fixed in 2.4.6 (released Aug 29, 2018, 127 days before disclosure).
The latest release, 2.8.5, is not affected.