Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the resolveAndValidateGeneric and validateTypeParameter methods of the DatabindContext class. An attacker can instantiate arbitrary classes by supplying a class-name type ID whose generic arguments o...