CVE-2026-47875: JobParameterDeserializer bypasses the trusted-type allowlist
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Affected deployments are applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts and using an untrusted data source for the job repository. The affected Spring Batch release ranges are 5.2.0 through 5.2.6 and 6.0.0 through 6.0.4.
What does an attacker need to exploit the vulnerability?
An attacker needs a way to supply malicious data through the untrusted job-repository data source. They can craft serialized input that bypasses the trusted-types allowlist and may trigger arbitrary code execution through known Jackson RCE gadgets.
How can I determine whether my application is affected?
Review whether the application uses Jackson2ExecutionContextStringSerializer for execution-context deserialization, whether its job repository reads from an untrusted data source, and whether it runs an affected Spring Batch version. If all of these conditions apply, the application is vulnerable.