Druid vulnerability patching

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3-flash-preview/fix-security-bug/druid-vulnerability-patching

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill druid-vulnerability-patching

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Techniques for identifying and patching vulnerabilities in Apache Druid, specifically focusing on Jackson deserialization and JavaScript security. Use this skill when dealing with CVEs related to RCE or security bypasses in Druid.

SKILL.md

1.7 KB, 296 tokens by cl100k_base, as published. Nobody here has run it

Druid Vulnerability Patching

Jackson Deserialization Security

Apache Druid uses Jackson for JSON deserialization. A common vulnerability is when injected values (via @JacksonInject) can be overridden by user-provided JSON properties.

Preventing Injection Overrides

To prevent a JSON property from overriding an injected value, use the useInput attribute of @JacksonInject set to OptBoolean.FALSE.

Example:

@JsonCreator
public MyObject(
    @JsonProperty("prop") String prop,
    @JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.FALSE) MyConfig config
)

Identifying Vulnerable Components

Search for all occurrences of @JacksonInject in the codebase, especially those involving configuration classes like JavaScriptConfig, AuthConfig, etc.

grep -r "@JacksonInject" .

JavaScript Security in Druid

Druid has a global configuration to enable/disable JavaScript execution. This is usually managed by JavaScriptConfig.

Security Checks

Always check config.isEnabled() before executing any JavaScript.

if (!config.isEnabled()) {
  throw new ISE("JavaScript is disabled");
}

Bypass via Empty Keys

Attackers may use empty keys "" in JSON to target parameters that lack a name during deserialization. Ensuring all constructor parameters have explicit @JsonProperty names or disabling input for @JacksonInject prevents this.