The vulnerabilities of the functions Introspector.getBeanInfo() and PropertyDescriptor.getReadMethod() in the Jinjava template rendering library allow a attacker to execute arbitrary code.

The vulnerabilities of the functions Introspector.getBeanInfo and PropertyDescriptor.getReadMethod in the jinjava template rendering library are related to the lack of measures taken to eliminate special elements in the template creation mechanism when processing the ForTag parameter. Exploiting...