Jinjava Server-Side Template Injection to RCE via Jackson ObjectMapper (CVE-2026-25526)

Metadata

Affected Target

Summary

CVE-2026-25526 is a sandbox-escape vulnerability in Jinjava, the Java template engine used by many JVM web applications for user-influenced templating. The PoC shows that Jinjava’s rendering context exposes an internal interpreter object (____int3rpr3t3r____) whose configuration includes a live Jackson ObjectMapper. By walking from the template context to config.objectMapper, an attacker can call methods like convertValue() and readValue() to construct arbitrary Java objects — first java.io.File handles for arbitrary file reads and directory listings, then (via enableDefaultTyping() and ProcessBuilder) fully-instantiated OS processes for remote code execution. The repo includes a staged exploit harness (ExploitHarness, ExploitFinal, ExploitFileRead) demonstrating file read, information disclosure, and RCE chains, plus a PatchVerification class confirming the chain is blocked once the library is bumped to 2.8.3.

Vulnerability Details

Root Cause

Jinjava templates can reach the rendering interpreter’s internal configuration object, exposing a Jackson ObjectMapper instance to template expressions. Because Jackson’s ObjectMapper (with default/polymorphic typing enabled) can instantiate arbitrary classes from type names supplied in the template, an attacker-controlled template turns into an arbitrary object-construction primitive, escalating from template rendering to full Java object instantiation and eventually process execution.

Attack Vector

1. Attacker gets a Jinjava template string rendered by the vulnerable host application (e.g. via a customizable email/document/report template feature).
2. Template accesses ____int3rpr3t3r____ to reach config.objectMapper and calls typeFactory.constructFromCanonical(...) plus convertValue/readValue to build a java.io.File object pointed at an arbitrary path, confirming file read/listing primitives.
3. Attacker escalates by enabling default typing on the ObjectMapper and deserializing a java.lang.ProcessBuilder with an attacker-chosen command array.
4. Calling .start() on the resulting ProcessBuilder executes the command, achieving remote code execution in the context of the host Java application.

Impact

Arbitrary file read (e.g. /etc/passwd, /etc/hosts) and full remote code execution within any application that renders untrusted Jinjava templates using an affected version of the library.

Environment / Lab Setup

Target:   Jinjava 2.8.2 (embedded in a Java 17 app via Maven dependency)
Attacker: JDK 17+, Maven 3.x, exec-maven-plugin (bundled in the included pom.xml)

Proof of Concept

PoC Script

See src/main/java/ExploitHarness.java, ExploitFinal.java, ExploitFileRead.java, PatchVerification.java, and pom.xml in this folder (compiled .class files included under target/classes/).

1
2
3
4

mvn exec:java -Dexec.mainClass=ExploitHarness -q
mvn exec:java -Dexec.mainClass=ExploitFinal -q
mvn exec:java -Dexec.mainClass=ExploitFileRead -q
mvn exec:java -Dexec.mainClass=PatchVerification -q

ExploitHarness walks through the step-by-step discovery of the primitive; ExploitFinal chains it into file creation/read and information-disclosure exploits; ExploitFileRead exfiltrates /etc/passwd and /etc/hosts contents; PatchVerification reruns the chains against Jinjava 2.8.3 (set in pom.xml) to confirm the fix blocks all of them.

Detection & Indicators of Compromise

Signs of compromise:

• Template inputs containing Jinjava control syntax ({% ... %}) referencing interpreter/config internals
• Unexplained child processes spawned by a Java application that only performs template rendering
• Application error logs referencing Jackson ObjectMapper type coercion failures on unexpected classes (e.g. File, URL, ProcessBuilder)

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/av4nth1ka/jinjava-cve-2026-25526-poc on 2026-07-05.