HubSpot / Jinjava
4 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-25526 | JinJava Bypass through ForTag leads to Arbitrary Java Execution | CRITICAL | 9.8 | Feb 4, 2026 |
| CVE-2025-59340 | jinjava Sandbox Bypass via JavaType-Based Deserialization | CRITICAL | 10.0 | Sep 17, 2025 |
| CVE-2020-12668 | Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the appl… | MEDIUM | 6.5 | Feb 19, 2021 |
| CVE-2018-18893 | Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java. | MEDIUM | 5.3 | Jan 3, 2019 |
Showing 1 to 4 of 4 CVEs