The vulnerability originates in the JobParameterDeserializer component used by Spring Batch to deserialize execution contexts. When an application allows an untrusted data source to provide job repository data, the deserializer does not enforce the trusted-types allowlist, enabling an attacker to construct malicious input. If executed, this malicious input can trigger arbitrary code execution through known Jackson RCE gadgets.

Affected products include Spring Batch version 6.0.0 through 6.0.4 and 5.2.0 through 5.2.6. These versions were identified by the CNA as vulnerable. The flaw exists in all builds of these releases that use Jackson2ExecutionContextStringSerializer for the job repository.

The CVSS score of 5.6 indicates a moderate severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the potential for arbitrary code execution is significant. An attacker would need to supply crafted serialized data to the job repository; if successful, they could execute code with the privileges of the application.