What’s Vulnerable › Vulnerabilities

CVE-2018-18893

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-03 · updated 2026-06-17

Description

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

Affected products

• HubSpot jinjava: before 2.4.6 — fixed in 2.4.6

How to fix

Upgrade to a fixed version: HubSpot jinjava 2.4.6. Check the vendor advisory for mitigations.

References

• https://github.com/HubSpot/jinjava/blob/master/CHANGES.md
• https://github.com/HubSpot/jinjava/pull/230
• https://github.com/HubSpot/jinjava/blob/master/CHANGES.md
• https://github.com/HubSpot/jinjava/pull/230

Get alerted when CVE-2018-18893 or the next vulnerability affects your stack