79 matches found
CVE-2025-59340
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
Improper Neutralization of Special Elements Used in a Template Engine
Overview com.hubspot.jinjava:jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates at least the subset of jinja in use in HubSpot content. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a...
CVE-2025-59340
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
CVE-2025-59340
Summary: CVE-2025-59340 affects jinjava (Java-based template engine). The issue arises when mapper.getTypeFactory().constructFromCanonical() allows attacker-controlled input to deserialize into arbitrary classes via ObjectMapper, enabling sandbox escape and potential access to local files/URLs (e...
CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
cn.sliew:carp-framework-template-jinja (>=0.0.80, <=0.0.89), cn.sliew:flinkful-kubernetes-controller (>=1.0.6, <=1.0.7) +12 more potentially affected by CVE-2025-59340 via com.hubspot.jinjava:jinjava (2.8.0)
com.hubspot.jinjava:jinjava MAVEN version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.hubspot.jinjava:jinjava and may be impacted: - cn.sliew:carp-framework-template-jinja =0.0.80, =1.0.6, =1.0.6, =1.0.6, =1.1, =1.19.4, =1.19.4, =1.19.4,...
ai.starlake:starlake-streaming_2.13 (>=1.3.3, <=1.3.5), chat.octet:llama-java-core (>=1.4.1, <=1.4.2) +252 more potentially affected by CVE-2025-59340 via com.hubspot.jinjava:jinjava (>=2.7.0, <=2.7.4)
com.hubspot.jinjava:jinjava MAVEN version =2.7.0, =1.3.3, =1.4.1, =0.5.0, =0.2.0, =0.5.0, =0.4.0, =0.1.3, =0.1.3, =0.5.0, =0.1.3, =0.1.3, =0.1.3, =0.1.3, =0.1.3, =0.3.2, =0.5.1 and more Source cves: CVE-2025-59340 Source advisory: GHSA-M49C-G9WR-HV6V...
GHSA-M49C-G9WR-HV6V jinjava has Sandbox Bypass via JavaType-Based Deserialization
Summary jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass, and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying...
CVE-2025-59340: Improper Neutralization of Special Elements Used in a Template Engine
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory.constructFromCanonical, it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classe...
HubSpot Jinjava 安全漏洞
HubSpot Jinjava is an application by the individual developers of HubSpotn in the United States. It provides a Java-based template templating engine, based on Django template syntax, suitable for rendering jinja templates. A security vulnerability exists in HubSpot Jinjava versions prior to 2.8.1...
PT-2025-38270
Name of the Vulnerable Software and Affected Versions jinjava versions prior to 2.8.1 Description jinjava is a Java-based template engine. A sandbox escape flaw exists due to unrestricted interaction with the properties of JinjavaInterpreter instances, specifically through the ObjectMapper. By...
CVE-2020-12668
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...
Oracle GoldenGate (Oct 2022 CPU)
The version of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices Dell BSAFE Micro Edition Suite. The supported version that is affected is...
Unauthorized access to Class instance in Jinjava
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...
GHSA-2HJR-FG6C-V2H6 Unauthorized access to Class instance in Jinjava
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...
Arbitrary Code Execution
jinjava is vulnerable to arbitrary code execution. An attacker is able to gain access to arbitrary classes via objects that are passed to the Jinjava context through the application class loader...
CVE-2020-12668
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...
CVE-2020-12668
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...