Critical HubSpot’s Jinjava Engine Vulnerability Exposes Thousands of Websites to RCE

EXECUTIVE SUMMARY:

A critical vulnerability CVE-2025-59340 has been discovered in HubSpot’s Jinjava template engine versions prior to 2.8.1 that allows attackers to bypass its sandbox protections and use methods like ObjectMapper.constructFromCanonical() to deserialize inputs into arbitrary classes. This makes it possible to access sensitive system files, perform SSRF, and potentially achieve remote code execution. The flaw has a high severity CVSS 9.8.