Jackson inject security
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill jackson-inject-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Fixing Jackson @JacksonInject bypass vulnerabilities where attackers use empty JSON keys to override injected values. Use this skill whenever reviewing or patching Java code that uses @JacksonInject for security-sensitive configuration injection, especially in Apache projects.
SKILL.md
1.6 KB, 284 tokens by cl100k_base, as published. Nobody here has run it
Jackson @JacksonInject Security Bypass
The Vulnerability
When a Java class uses @JacksonInject without specifying useInput, Jackson's default behavior allows JSON input to override the injected value. An attacker can exploit this by providing an empty key "" in the JSON payload, which Jackson maps to the @JacksonInject parameter (since it has no explicit property name).
// VULNERABLE: JSON input can override the injected config
@JacksonInject JavaScriptConfig config
The Fix
Use useInput = OptBoolean.NEVER to prevent JSON input from overriding injected values:
// SECURE: JSON input is ignored for this parameter
@JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.NEVER) JavaScriptConfig config
This requires Jackson 2.9+ (where OptBoolean was introduced).
Key Points
- The empty key
""is the default internal name Jackson uses for@JacksonInjectparameters without@JsonProperty useInput = OptBoolean.NEVERtells Jackson to always use the injected value, never the JSON input- This is a defense-in-depth fix — it prevents the bypass regardless of what JSON the attacker sends
- All
@JacksonInjectparameters used for security-sensitive configuration should useuseInput = OptBoolean.NEVER