CVE-2020-12668 Unauthorized access to Class instance in Jinjava

What is CVE-2020-12668?

CVE-2020-12668 is a medium-severity code injection vulnerability in n/a, published on 19 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.

Weakness: CWE-863

Which versions are affected by CVE-2020-12668?

2 open source packages ship an affected version, including com.hubspot.jinjava:jinjava. It affects 1 product.

Products include Hubspot Jinjava.

How do I fix CVE-2020-12668?

Upgrade com.hubspot.jinjava:jinjava to 2.5.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-12668 being exploited?

There is no known exploitation of CVE-2020-12668 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution Critical 9.8
• CVE-2025-59340 jinjava Sandbox Bypass via JavaType-Based Deserialization Critical 9.8
• CVE-2018-18893 Jinjava calls getClass Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2hjr-fg6c-v2h6.