79 matches found
ai.starlake:starlake-streaming_2.13 (>=1.3.3, <=1.3.5), chat.octet:llama-java-core (>=1.4.1, <=1.4.2) +328 more potentially affected by CVE-2026-25526 via com.hubspot.jinjava:jinjava (>=2.0.5, <=2.7.4)
com.hubspot.jinjava:jinjava MAVEN version =2.0.5, =1.3.3, =1.4.1, =0.5.0, =0.2.0, =0.5.0, =0.4.0, =0.1.3, =0.1.3, =0.5.0, =0.1.3, =0.1.3, =0.1.3, =0.1.3, =0.1.3, =0.3.2, =0.5.1 and more Source cves: CVE-2026-25526 Source advisory: OSV:GHSA-GJX9-J8F8-7J74...
cn.datask:dat-adapter-duckdb (>=0.6.1, <=0.7.1), cn.datask:dat-adapter-mysql (>=0.6.1, <=0.7.1) +159 more potentially affected by CVE-2026-25526 via com.hubspot.jinjava:jinjava (>=2.8.0, <=2.8.2)
com.hubspot.jinjava:jinjava MAVEN version =2.8.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.1 and more Source cves: CVE-2026-25526 Source advisory: OSV:GHSA-GJX9-J8F8-7J74...
GHSA-GJX9-J8F8-7J74 JinJava Bypass through ForTag leads to Arbitrary Java Execution
Impact Vulnerability Type: Sandbox Bypass / Remote Code Execution Affected Component: Jinjava Affected Users: - Organizations using HubSpot's Jinjava template rendering engine for user-provided template content - Any system that renders untrusted Jinja templates using HubSpot's Jinjava...
cn.datask:dat-adapter-duckdb (>=0.6.1, <=0.7.1), cn.datask:dat-adapter-mysql (>=0.6.1, <=0.7.1) +159 more potentially affected by CVE-2026-25526 via com.hubspot.jinjava:jinjava (>=2.8.0, <=2.8.2)
com.hubspot.jinjava:jinjava MAVEN version =2.8.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.1 and more Source cves: CVE-2026-25526 Source advisory: GHSA-GJX9-J8F8-7J74...
PT-2026-6313
Name of the Vulnerable Software and Affected Versions JinJava versions prior to 2.7.6 JinJava versions prior to 2.8.3 Description JinJava is a Java-based template engine that uses django template syntax to render jinja templates. A flaw exists in the ForTag component that allows for arbitrary Jav...
jinjava Template Rendering Library Code Execution
The vulnerability of the constructFromCanonical function in the jinjava template rendering library is related to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Deserialization Of Untrusted Data
com.hubspot.jinjava, jinjava is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to use of mapper.getTypeFactory.constructFromCanonical which allows the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes...
CVE-2025-37729
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
EUVD-2025-34069
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
CVE-2025-37729
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
CVE-2025-37729
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
CVE-2025-37729
Elastic Cloud Enterprise (ECE) is affected by CVE-2025-37729 due to improper neutralization of Jinjava template elements. The issue allows a user with Admin access to exfiltrate sensitive information and issue commands through a specially crafted string that causes Jinjava variables to be evaluat...
CVE-2025-37729 Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
CVE-2025-37729 Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
Elastic Cloud Enterprise (ECE) 3.8.2 and 4.0.2 Security Update (ESA-2025-21)
Elastic Cloud Enterprise ECE Improper Neutralization of Special Elements Used in a Template Engine ESA-2025-21 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information a...
PT-2025-41785
Name of the Vulnerable Software and Affected Versions Elastic Cloud Enterprise versions 2.5.0 through 3.8.1 Elastic Cloud Enterprise version 4.0.0 through 4.0.1 Description An issue exists in Elastic Cloud Enterprise ECE related to the improper handling of special elements within its template...
CVE-2025-37729: Improper Neutralization of Special Elements Used in a Template Engine
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...
EUVD-2019-0172
Malware in sbrugna...