CVE-2025-59340: jinjava Sandbox Bypass via JavaType-Based Deserialization

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-06-17
Weakness: CWE-1336

Description

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.

Affected products

HubSpot jinjava: before 2.8.1 — fixed in 2.8.1

How to fix

Upgrade to a fixed version: HubSpot jinjava 2.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59340 or the next vulnerability affects your stack