Critical Sandbox Bypass Vulnerability in Jinjava Allows Arbitrary Java Execution
Summary
GHSA-gjx9-j8f8-7j74: JinJava Bypass through ForTag leads to Arbitrary Java Execution. Affects com.hubspot.jinjava:jinjava across 2 version ranges.
< 2.7.6
>= 2.8.0, < 2.8.3
Fixed in 2.7.6 or 2.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jinjava is a template rendering engine developed by HubSpot, primarily used for rendering Jinja templates in Java applications. It enables developers to create dynamic content by allowing user-provided templates to be processed safely. However, vulnerabilities in its sandboxing mechanism can lead to severe security risks, particularly when untrusted templates are rendered.
Vulnerability Detail
The vulnerability in Jinjava arises from multiple security bypass flaws in its sandbox mechanism, specifically through the ForTag class. This allows attackers to access arbitrary getter methods on objects in the template context, instantiate classes through JSON deserialization, and potentially execute arbitrary code. The critical nature of this vulnerability is underscored by its ability to bypass built-in sandbox restrictions, leading to arbitrary Java class instantiation and unauthorized file access.
How To Fix
Latest published version: 2.8.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.62.7.6 -
>= 2.8.0, < 2.8.32.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as possible.
Conclusion
The Jinjava vulnerability presents a significant risk due to its ability to bypass sandbox restrictions, allowing for arbitrary code execution. Users are strongly advised to upgrade to the latest versions to ensure their applications remain secure.
See every vulnerability recorded for com.hubspot.jinjava:jinjava →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Organizations using HubSpot's Jinjava for user-provided templates and any system rendering untrusted Jinja templates are at risk.
Attackers can access arbitrary Java classes, read files from the server, and potentially execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize the upgrade to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hubspot.jinjava:jinjava.
