CVE-2026-47875 PUBLISHED

JobParameterDeserializer bypasses the trusted-type allowlist

Assigner: vmware
Reserved: 20.05.2026 Published: 27.08.2026 Updated: 27.08.2026

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 5.6

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Spring
Product	Spring Batch
Versions	Default: unaffected affected from 6.0.0 to 6.0.4 (incl.) affected from 5.2.0 to 5.2.6 (incl.)

References

https://spring.io/security/cve-2026-47875

Problem Types

CWE-502 Deserialization of Untrusted Data CWE

Impacts

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.