The vulnerability of the constructFromCanonical() function in the jinjava template rendering library allows a attacker to execute arbitrary code.

The vulnerability of the constructFromCanonical function in the jinjava template rendering library is related to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Deserialization Of Untrusted Data

com.hubspot.jinjava, jinjava is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to use of mapper.getTypeFactory.constructFromCanonical which allows the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes...