CVE-2018-18893 Jinjava calls getClass

What is CVE-2018-18893?

CVE-2018-18893 is a medium-severity code injection vulnerability in n/a, published on 3 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.

Which versions are affected by CVE-2018-18893?

2 open source packages ship an affected version, including com.hubspot.jinjava:jinjava. It affects 1 product.

Products include Hubspot Jinjava.

How do I fix CVE-2018-18893?

Upgrade com.hubspot.jinjava:jinjava to 2.4.6 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-18893 being exploited?

There is no known exploitation of CVE-2018-18893 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution Critical 9.8
• CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization Critical 9.8
• CVE-2020-12668 Unauthorized access to Class instance in Jinjava Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-45r8-3495-x6rm.