Advisories for Maven/Com.hubspot.jinjava/Jinjava package

Vulnerability Type: Sandbox Bypass / Remote Code Execution Affected Component: Jinjava Affected Users: Organizations using HubSpot's Jinjava template rendering engine for user-provided template content Any system that renders untrusted Jinja templates using HubSpot's Jinjava implementation Users with the ability to create or edit custom code templates Severity: Critical - allows arbitrary Java class instantiation and file access bypassing built-in sandbox restrictions Root Cause: Multiple security bypass vulnerabilities in Jinjava's sandbox …

jinjava’s current sandbox restrictions prevent direct access to dangerous methods such as getClass(), and block instantiation of Class objects. However, these protections can be bypassed. By using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate …

Jinjava allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

Jinjava does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.