CVE-2025-59340: HubSpot Jinjava sandbox bypass via JavaType deserialization

CVE-2025-59340 · Severity: critical · CVSS 9.8 · Published 2025-09-17

HubSpot Jinjava is a Java-based template engine used to generate dynamic content. A security flaw allows an attacker to bypass the engine's safety sandbox by manipulating internal Java objects. This could allow an unauthorized user to read sensitive local files, access internal network resources, or potentially take full control of the server.

Technologies: com.hubspot.jinjava:jinjava (Maven). Vendors: Maven.

Quick answers

Is CVE-2025-59340 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59340 being exploited in the wild.
How severe is CVE-2025-59340?
Critical severity, with a CVSS score of 9.8, published 17 September 2025.
Which products and versions are affected?
HubSpot Jinjava = 2.8.0, >= 2.7.0, < 2.7.5; com.hubspot.jinjava:jinjava (Maven) ECOSYSTEM:introduced=2.8.0,fixed=2.8.1.
Is there a fix for CVE-2025-59340?
Yes. com.hubspot.jinjava:jinjava (Maven): upgrade to 2.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59340 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59340?
Check whether you run HubSpot Jinjava or com.hubspot.jinjava:jinjava (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.hubspot.jinjava:jinjava (Maven): upgrade to 2.8.1 or later
    # set com.hubspot.jinjava:jinjava to 2.8.1 in your pom.xml or build.gradle

Technical details

A sandbox bypass exists in Jinjava due to improper neutralization of special elements in the template engine (CWE-1336). Attackers can access the internal '____int3rpr3t3r____' variable to reach the ObjectMapper configuration. By leveraging the 'JavaType' class and 'constructFromCanonical' method, which were not restricted by the JinjavaBeanELResolver, an attacker can deserialize input into arbitrary Java classes. This primitive allows for the instantiation of dangerous classes like java.net.URL, leading to arbitrary file read, SSRF, and potentially remote code execution. The vulnerability is patched in versions 2.8.1 and 2.7.5.

Affected products

  • HubSpot jinjava = 2.8.0, >= 2.7.0, < 2.7.5

Identifiers

  • CVE-2025-59340
  • GHSA-m49c-g9wr-hv6v

Timeline

  • 2025-09-17: disclosed
  • 2025-09-17: advisory
  • 2025-09-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.