maven package report

Is org.springframework.batch:spring-batch-core safe?

2 known vulnerabilities, worst severity HIGH.

cvss
7.5

how bad it is if exploited, out of 10

epss
1.8%

chance of exploitation in the next 30 days

xyz score
3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-4ph4-q9r5-6wm6, the advisory selected below

// advisories

GHSA-4ph4-q9r5-6wm6

HIGHCVE-2020-5411

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true:

Affected
>= 4.0.0, <= 4.2.2
Fixed in
4.2.3
Weakness
CWE-502
Published
2022-05-24
Source
github

GHSANVDMITREreference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 03:27 UTC. The most recent advisory here was published 2022-05-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is org.springframework.batch:spring-batch-core safe? maven package security report | CyberXYZ