Spring Integration's JsonToObjectTransformer determines the target class for JSON deserialization from a message header named json__TypeId__. The implementation uses ClassUtils.forName without restricting the classes that may be resolved. Based on the description, it is inferred that an attacker can supply a crafted header value that points to any class available on the application’s JVM, thereby triggering deserialization of malicious data. If the payload and the target class interact in a way that enables code execution, the vulnerability allows an attacker to run arbitrary code within the application’s process.

The affected product is Spring Integration from the Spring vendor. Versions that are vulnerable include 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. Any deployment that incorporates one of these releases and exposes the JsonToObjectTransformer to untrusted input is at risk.

The CVSS score of 6.3 classifies the issue as medium severity. The EPSS score shows a very low exploitation probability (< 1 %). The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is injection of a crafted json__TypeId__ header via network or internal messaging channels. Attackers can exploit the flaw by sending such a header, and no publicly known exploits are currently available. The absence of an allow‑list renders the condition effectively satisfied whenever the header is supplied.