Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

SnakeYAML 1.27 vulnerability in Jinjava 2.7.1

Open
#1,115 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
java
Domain
security

Research direction

Start by locating the Maven dependency declaration that brings SnakeYAML into Jinjava, then inspect the referenced Jinjava and Jackson YAML versions. Run the existing test suite after selecting a non-vulnerable compatible version; done means the dependency is upgraded without regressions and the reported SnakeYAML vulnerabilities are resolved.

Written by the indexing model from the issue text.

Description

Hi Team,
We recently found out that SnakeYAML library 1.27 has some vulnerabilities which are fixed in later versions-

snakeyaml 1.27 1.31 java-archive GHSA-3mc7-4q67-w48m High
snakeyaml 1.27 1.31 java-archive GHSA-98wm-3w3q-mw94 Medium
snakeyaml 1.27 1.31 java-archive GHSA-c4r9-r8fh-9vj2 Medium
snakeyaml 1.27 1.31 java-archive GHSA-hhhw-99gj-p3c3 Medium
snakeyaml 1.27 1.32 java-archive GHSA-9w3m-gqgf-c4p9 Medium
snakeyaml 1.27 1.32 java-archive GHSA-w37g-rhq8-7m4j Medium
snakeyaml 1.27 2.0 java-archive GHSA-mjmj-j48q-9wg2 High

I traced down the version of Snakeyaml for the 2.7.1 Jinjava -

Maven Repository: com.hubspot.jinjava » jinjava » 2.7.1
As per their POM https://repo1.maven.org/maven2/com/hubspot/jinjava/jinjava/2.7.0/jinjava-2.7.0.pom
Maven Repository: com.fasterxml.jackson.dataformat » jackson-dataformat-yaml » 2.12.6
-->
https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.12.6/jackson-dataformat-yaml-2.12.6.pom
--> SnakeYAML 1.27

Could we please prioritize this for the next release ? This will be a great relief for all the users.
Regards,
Souptik

Dominant language
Java
Stars
785
Forks
184
Avg merge
6d 22h
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HubSpot/jinjava

All issues in HubSpot/jinjava

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.