{"action":"Upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.9 (2.18.x) or 2.21.5 (2.21.x) or later.","affected":[{"fixed":"2.18.9","introduced":"2.18.0"},{"fixed":"2.21.5","introduced":"2.21.0"}],"component":"com.fasterxml.jackson.core:jackson-databind","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["2.18.9","2.21.5"],"ghsa_id":"GHSA-mhm7-754m-9p8w","id":"tcs_01M5N955ETMVFAPA4XVGX2QY2V","modified_at":"2026-09-10T03:50:52.852212609Z","published_at":"2026-07-21T19:40:12Z","references":["https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w","https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed","https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c","https://github.com/FasterXML/jackson-databind"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-mhm7-754m-9p8w","url":"https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w"}],"summary":"jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`"}