CVE-2026-25526: HubSpot JinJava: ForTag sandbox bypass enabling arbitrary Java execution
CVE-2026-25526 is a critical sandbox bypass in HubSpot JinJava, a Java template engine, through its ForTag component. According to the record, it allows arbitrary Java class instantiation and file access, and the CNA scores it 9.8 under CVSS v3.1. The issue is fixed in versions 2.7.6 and 2.8.3, and no confirmed exploitation appears in the sources consulted.
Overview
JinJava is a Java template engine that uses Django-style template syntax and is adapted to render Jinja templates. CVE-2026-25526 describes a bypass of the built-in sandbox through the ForTag component, which the record says can lead to arbitrary Java execution. The CVE record is classified under CWE-1336.
Impact
The record states that the flaw allows arbitrary Java class instantiation and file access while bypassing the built-in sandbox restrictions. The CNA rates it Critical with a CVSS v3.1 base score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which, read in the standard way, indicates network reachability, low complexity and no required privileges or user interaction.
The practical risk depends on whether an application lets untrusted parties supply or influence template content, because a sandbox bypass is most dangerous when the attacker controls what gets rendered.
Affected products and versions
The CNA data lists Hubspot Jinjava in the following ranges:
- Versions before 2.7.6.
- Versions from 2.8.0 up to, but not including, 2.8.3.
Versions outside these ranges are not listed as affected in the record.
Exploitation status
The CISA KEV catalog does not list this CVE, and no EPSS score is present in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
Remediation and mitigation
The record states the issue is patched in versions 2.7.6 and 2.8.3. Teams running the 2.7 line should move to 2.7.6 or later, and teams on the 2.8 line should move to 2.8.3 or later. Review the vendor advisory and the 2.7.6 release notes and 2.8.3 release notes before rollout.
Until patching is complete, limit who can author or modify templates, do not render templates from untrusted sources, and run the rendering process with least privilege so that file access is constrained.
Detection guidance
- Inventory applications and build files that depend on JinJava, including transitive dependencies, and record the version in use.
- Identify services that render user-supplied or externally stored templates.
- Review application logs for unexpected template rendering errors or unusual file access by the process that renders templates.
Limitations of the available information
The record does not include technical details, proof-of-concept material or independent analysis, so the exact conditions for exploitation are unknown. The CWE name is not provided in the record. It is also unknown whether other branches or deployment configurations are affected beyond the listed ranges, and the record does not say whether earlier releases were tested.
Frequently asked questions
What is CVE-2026-25526?
It is a critical sandbox bypass in HubSpot JinJava, a Java template engine, through the ForTag component. The record says it can allow arbitrary Java class instantiation and file access.
Which versions are affected?
The CNA data lists versions before 2.7.6 and versions from 2.8.0 up to, but not including, 2.8.3 as affected.
Is this vulnerability known to be exploited?
It is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.