Filtered by vendor Hubspot Subscriptions
Filtered by product Jinjava Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-59340 1 Hubspot 1 Jinjava 2025-09-18 9.8 Critical
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.
CVE-2020-12668 1 Hubspot 1 Jinjava 2024-11-21 6.5 Medium
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
CVE-2018-18893 1 Hubspot 1 Jinjava 2024-11-21 N/A
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.