Came across something in pom.xml around line 162 that looked worth flagging.
The vulnerability is real: Jackson databind 2.18.6 uses BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() which only checks if a class is an array (clazz.isArray()) without validating the array's element type. This bypasses configured allowlists, allowing deserialization of arbitrary malicious types (e.g., EvilType[]) and can lead to remote code execution when processing untrusted input.
Something like this might fix it:
--- a/pom.xml
+++ b/pom.xml
@@ -159,7 +159,7 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
- <version>2.18.6</version>
+ <version>2.18.8</version>
</dependency>For reference: rule CVE-2026-54513. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
pom.xmlaround line 162 that looked worth flagging.The vulnerability is real: Jackson databind 2.18.6 uses BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() which only checks if a class is an array (clazz.isArray()) without validating the array's element type. This bypasses configured allowlists, allowing deserialization of arbitrary malicious types (e.g., EvilType[]) and can lead to remote code execution when processing untrusted input.
Something like this might fix it:
For reference: rule
CVE-2026-54513. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.