Threats affecting pkg:maven/com.hubspot/jinjava

CVE-2026-25526 is a critical vulnerability in HubSpot's JinJava template engine versions prior to 2.7.6 and 2.8.3. It allows unauthenticated remote attackers to execute arbitrary Java code by bypassing sandbox restrictions through the ForTag template construct. This leads to full compromise of confidentiality, integrity, and availability of affected systems without requiring user interaction. The vulnerability arises from improper neutralization of special elements used in the template engine (CWE-1336). Although no known exploits are currently in the wild, the high CVSS score of 9.8 indicates a severe risk.