49 matches found
EUVD-2026-69250
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types incomplete PolymorphicTypeValidator denylist...
Malicious code in comparable-tan-snake (npm)
Source: amazon-inspector 0f4241a4fe88b63b681d8b8605692ccf2a8f5e2142c813b6e1b2105d98f51aca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in comparable-purple-hamster (npm)
Source: amazon-inspector dfb2e700d404a88b007174f866cb68b2430d139e2e414da16f2b386e53a16bf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in comparable-gray-aardwolf (npm)
Source: amazon-inspector af67cb484f0274d22bc4c8138274b45d40c5e3bf3400b07c11cd144077b9062d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in comparable-apricot-perch (npm)
Source: amazon-inspector 9a79adca39269fb6c35afd90657396c6af67d608146d087df0dc823d3a8afc57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in comparable-gold-hedgehog (npm)
Source: amazon-inspector d295a7d96ef705820b22218bd2f3e00cac0d43d9c89fd24847241ecf54287f57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in comparable-scarlet-perch (npm)
--- Credit: OpenSSF source...
SUSE CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
Deserialization of Untrusted Data
Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType method of...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable...
DEBIAN-CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...
PT-2026-84291
Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.11.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1...
Malicious code in comparable_dormouse_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01029bf5cad48a4efb9f84dd25e81a2ef705a98d3b399161d3c01d62613ffa18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...