CVE-2025-59340: Critical HubSpot’s Jinjava Engine Flaw Exposes Thousands of Websites to RCE

CVE-2025-59340 is a critical flaw in HubSpot’s Jinjava template engine that powers thousands of websites and processes hundreds of millions of page views per month on the HubSpot CMS. The vulnerability (CVSS 9.8) could allow attackers to bypass Jinjava’s sandbox restrictions and escalate to full remote code execution.

By abusing the constructFromCanonical() method of the underlying ObjectMapper, a crafted template can deserialize input into arbitrary classes, potentially enabling access to local files and server-side request forgery. A working exploit was demonstrated against Jinjava 2.8.0, confirming the vulnerability is actively exploitable. Affected versions are Jinjava < 2.8.1, with a patch available in 2.8.1; HubSpot urges immediate upgrades.

According to HubSpot, sandbox protections can be bypassed and a wide range of classes can be instantiated, which in certain environments could lead to read arbitrary files and full SSRF, potentially enabling remote code execution.