CVE-2026-25526

Name of the Vulnerable Software and Affected Versions JinJava versions prior to 2.7.6 JinJava versions prior to 2.8.3

Description JinJava is a Java-based template engine that uses django template syntax to render jinja templates. A flaw exists in the ForTag component that allows for arbitrary Java execution. This bypasses built-in sandbox restrictions, enabling arbitrary Java class instantiation and file access. The issue allows an attacker to circumvent security measures and potentially gain control of the system.

Recommendations Update JinJava to version 2.7.6 or later. Update JinJava to version 2.8.3 or later.