CVE-2025-59340: Sandbox Bypass in com.hubspot.jinjava:jinjava Allows Arbitrary Class Instantiation
Summary
CVE-2025-59340: jinjava has Sandbox Bypass via JavaType-Based Deserialization. Affects com.hubspot.jinjava:jinjava versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jinjava is a templating engine for Java that allows developers to create dynamic web content. It is widely used for rendering templates in web applications, providing features such as variable interpolation, control structures, and filters. However, Jinjava has a critical vulnerability that allows attackers to bypass its sandbox restrictions, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability arises from Jinjava's sandboxing mechanism, which is designed to prevent access to dangerous methods and classes. Despite these protections, an attacker can exploit the built-in variable 'int3rpr3t3r' to access the JinjavaInterpreter instance and traverse to the 'config' field, which exposes an ObjectMapper. By invoking the 'readValue' method on this ObjectMapper with a crafted input, an attacker can instantiate arbitrary classes using JavaType, effectively escaping the sandbox. This can lead to unauthorized access to local files and even remote code execution (RCE). The vulnerability is classified as critical with a CVSS score of 9.8.
How To Fix
Latest published version: 2.8.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Jinjava templates that expose the 'int3rpr3t3r' variable or limit the input to trusted sources only. Additionally, consider implementing strict input validation to mitigate the risk of arbitrary class instantiation.
Conclusion
CVE-2025-59340 is a critical vulnerability in the Jinjava templating engine that allows for sandbox bypass and arbitrary class instantiation. It is essential to update to version 2.8.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in your applications.
See every vulnerability recorded for com.hubspot.jinjava:jinjava →
FAQ
CVE-2025-59340 is a critical vulnerability in the Jinjava templating engine that allows attackers to bypass sandbox restrictions and instantiate arbitrary classes.
If your application uses Jinjava and is vulnerable, attackers could exploit this to read sensitive files or execute arbitrary code, leading to severe security breaches.
Versions of Jinjava prior to 2.8.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's pom.xml at Vulert's playground without any signup.
If you cannot update, implement strict input validation and avoid exposing the 'int3rpr3t3r' variable in your templates as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hubspot.jinjava:jinjava.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
