GHSA-WJGM-6HV5-3CVF jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

The vulnerability of the `NioPathHelper.deserialize` method in the Jackson-Databind library allows a hacker to load arbitrary files.

The vulnerability of the NioPathHelper.deserialize method in the Jackson-Databind library is related to insecure dynamic class loading. Exploiting this vulnerability could allow an attacker to load arbitrary files...