## cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-47875
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47875)
- パーマリンク: https://vulnpulse.app/items/spring-security-2d39b5fc97c7

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.