Executive brief
Jackson Databind is a widely-used Java library for converting between JSON and Java objects. When an application uses the @JsonTypeInfo annotation without configuring a custom security validator, Jackson automatically applies a permissive default validator that fails to block unsafe base types like java.lang.Comparable. This flaw allows attackers to instantiate arbitrary classes (such as java.io.File) during deserialization, potentially enabling file path traversal or other object-manipulation attacks depending on how the deserialized object is subsequently used by the application.
Technical details
This vulnerability exists in Jackson Databind's DefaultBaseTypeLimitingValidator, which is applied automatically when @JsonTypeInfo is used without an explicit custom PolymorphicTypeValidator. The validator maintains a blocklist of unsafe base types (including java.io.Serializable) but omitted java.lang.Comparable despite it being implemented by a vast fraction of JDK and application classes. An attacker can supply a type identifier for any class implementing Comparable to trigger arbitrary object instantiation. The demonstrated attack constructs java.io.File objects with attacker-controlled paths, enabling path-traversal-adjacent attacks when the application subsequently invokes path-sensitive methods. Code execution through deserialization alone has not been identified. The vulnerability does not affect Global Default Typing via activateDefaultTyping, which structurally requires an explicit PolymorphicTypeValidator argument.
Affected products
- FasterXML Jackson Databind 2.11.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixes available in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2