Jackson druid cve
Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-gemini-3.1-pro-preview/fix-security-bug/jackson-druid-cve
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill jackson-druid-cveAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Security and Jackson deserialization issues in Apache Druid, focusing on property bypasses.
SKILL.md
0.8 KB, as published. Nobody here has run it
Jackson Deserialization Security in Druid
When dealing with Jackson, unknown properties or empty properties can sometimes be mapped to configuration objects or bypass validation if @JsonCreator is not carefully constrained. This can lead to security vulnerabilities.
In Apache Druid, configuration classes like JavaScriptConfig are often passed via dependency injection or default constructors, and mapped from JSON if not disabled.
Techniques
- Restricting JSON properties using
@JsonIgnoreProperties - Throwing exceptions on unknown properties
- Ensuring that
@JacksonInjector required properties cannot be overridden by user input like"".