Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Remediation
References
Related Vulnerabilities
WordPress Plugin BetterOptin Cross-Site Scripting (2.0.2)
Magento CVE-2019-7895 Vulnerability (CVE-2019-7895)
WordPress 2.0.5 Cross-Site Scripting Vulnerability (0.6.2 - 2.0.5)
WordPress Plugin Media Mirror Cross-Site Scripting (1.0.6)
MongoDb Improper Check for Certificate Revocation Vulnerability (CVE-2025-3085)