What is the CVSS score of CVE-2026-25526?

CVE-2026-25526 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-25526?

A critical vulnerability in JinJava (CVSS 9.8) allows attackers to execute arbitrary Java code on systems using affected versions, potentially compromising application integrity and sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-25526?

Within 24 hours: identify all systems running JinJava and determine which versions are deployed; isolate or restrict network access to affected applications if immediate patching is not feasible. Within 7 days: apply vendor patches (upgrade to JinJava 2.7.6 or 2.8.3 or later) to all affected systems and validate patches in a test environment first. Within 30 days: complete patch deployment across production environments, conduct vulnerability rescans to confirm remediation, and review application logs for evidence of exploitation attempts.

Java CVE-2026-25526

CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-02-04 security-advisories@github.com

GHSA-gjx9-j8f8-7j74

Java Golang Django Jinjava

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 20, 2026 - 21:00 nvd

Patch available

CVE Published

Feb 04, 2026 - 22:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 maven packages depend on com.hubspot.jinjava:jinjava (6 direct, 8 indirect)

Ecosystem-wide dependent count for version 2.8.0.

DescriptionGitHub Advisory

JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3, JinJava is vulnerable to arbitrary Java execution via bypass through ForTag. This allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions. This issue has been patched in versions 2.7.6 and 2.8.3.

AnalysisAI

JinJava template engine has a server-side template injection vulnerability enabling arbitrary code execution through crafted Jinja-style templates.

Technical ContextAI

JinJava, a Java-based template engine using Jinja/Django syntax, has a CWE-1336 SSTI vulnerability that allows attackers to inject template expressions that execute arbitrary code.

RemediationAI

Update JinJava. Use sandboxed rendering mode.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2025-69516 HIGH POC

8.8

CVE-2025-49136 CRITICAL POC

9.0

CVE-2025-53833 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-23211 CRITICAL POC

9.9

CVE-2026-25526 vulnerability details – vuln.today

Back

Java CVE-2026-25526

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

Share

External POC / Exploit Code