CVE-2025-59340

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.

• CWE-1336

• https://github.com/HubSpot/jinjava/commit/66df351e7e8ad71ca04dcacb4b65782af820b8b1Patch
• https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.1Release Notes
• https://github.com/HubSpot/jinjava/security/advisories/GHSA-m49c-g9wr-hv6vVendor Advisory

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59334Linkr is a lightweight file delivery system that downloads f…8.8
• CVE-2025-59335CubeCart is an ecommerce software solution. Prior to version…7.1
• CVE-2025-59336Luanox is a module host for Lua packages. Prior to 0.1.1, a …6.9
• CVE-2025-59337Discourse is an open-source community discussion platform. I…6.8
• CVE-2025-59339The Bastion provides authentication, authorization, traceabi…4.4
• CVE-2025-5934A vulnerability was found in Netgear EX3700 up to 1.0.0.88. …8.8
• CVE-2025-59341esm.sh is a nobuild content delivery network(CDN) for modern…7.7
• CVE-2025-59342esm.sh is a nobuild content delivery network(CDN) for modern…5.5
• CVE-2025-59343tar-fs provides filesystem bindings for tar-stream. Versions…8.7
• CVE-2025-59344AliasVault is a privacy-first password manager with built-in…7.7
• CVE-2025-59345Dragonfly is an open source P2P-based file distribution and …9.1
• CVE-2025-59346Dragonfly is an open source P2P-based file distribution and …5.3