HubSpot’s Jinjava Engine Flaw Exposes Thousands of Sites to RCE Attacks

HubSpot’s Jinjava template engine has a critical flaw that could expose thousands of sites to remote code execution. The issue, tracked as CVE-2025-59340, carries a CVSS v3.1 score of 10.0 and stems from a sandbox bypass that lets attackers circumvent Jinjava’s security restrictions designed to block dangerous methods and object instantiation.

Security researchers showed that protections can be bypassed via JavaType-based deserialization, enabling an attacker to access the jinjavaInterpreter, traverse to the config field, and use the ObjectMapper’s readValue method to instantiate arbitrary classes. The vulnerability affects Jinjava versions prior to 2.8.1, with 2.8.1 released as a patch.

Exploitation can read arbitrary files from the server filesystem, conduct SSRF, and potentially achieve full remote code execution depending on the environment’s available classes. The flaw requires network access and no special user interaction, making it easily exploitable by remote attackers. Administrators should upgrade to version 2.8.1 or later and audit Jinjava usage to prioritise patching given the severity. The vulnerability was disclosed in coordination with security researchers taisehub and odgrso.