fix: upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.8, 2.21.4, 3.1.4 (CVE-2026-54513)

[anupamme]

Summary

Upgrade com.fasterxml.jackson.core:jackson-databind from 2.15.4 to 2.18.8, 2.21.4, 3.1.4 to fix CVE-2026-54513.

Vulnerability

Field	Value
ID	CVE-2026-54513
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-54513
File	jeecg-boot/jeecg-boot-base-core/pom.xml
Assessment	Likely exploitable

Description: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

Evidence

Scanner confirmation: trivy rule CVE-2026-54513 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• jeecg-boot/pom.xml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[dannywang0422]

取消定义这个消息 发件人: Anupam Mediratta ***@***.***> 日期: 星期二, 2026年7月21日 08:22 收件人: jeecgboot/JeecgBoot ***@***.***> 抄送: Subscribed ***@***.***> 主题: [jeecgboot/JeecgBoot] fix: upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.8, 2.21.4, 3.1.4 (CVE-2026-54513) (PR #9789) ** 注意：外部邮件，请谨慎操作 | CAUTION: External email. Use caution with links and attachments ** Summary Upgrade com.fasterxml.jackson.core:jackson-databind from 2.15.4 to 2.18.8, 2.21.4, 3.1.4 to fix CVE-2026-54513<https://github.com/advisories/GHSA-rmj7-2vxq-3g9f>. Vulnerability Field Value ID CVE-2026-54513<https://github.com/advisories/GHSA-rmj7-2vxq-3g9f> Severity HIGH Scanner trivy Rule CVE-2026-54513 File jeecg-boot/jeecg-boot-base-core/pom.xml Assessment Likely exploitable Description: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution Evidence Scanner confirmation: trivy rule CVE-2026-54513 flagged this pattern. Production code: This file is in the production codebase, not test-only code. Changes * jeecg-boot/pom.xml Verification * Build passes * Scanner re-scan confirms fix * LLM code review passed

…

________________________________ This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

________________________________ Automated security fix by OrbisAI Security<https://orbisappsec.com>

________________________________ You can view, comment on, or merge this pull request online at: #9789 Commit Summary * 2655240<2655240> fix: CVE-2026-54513 security vulnerability File Changes (1 file<https://github.com/jeecgboot/JeecgBoot/pull/9789/files>) * M jeecg-boot/pom.xml<https://github.com/jeecgboot/JeecgBoot/pull/9789/files#diff-ffb5af3cf9e92ba0a97ebe8bf7b1809cc914bbde58f9f3ce69d2756cffe381e7> (8) Patch Links: * https://github.com/jeecgboot/JeecgBoot/pull/9789.patch * https://github.com/jeecgboot/JeecgBoot/pull/9789.diff ― Reply to this email directly, view it on GitHub<#9789?email_source=notifications&email_token=BPG6ECYACUVF6N7D37GK2XT5F2ZVBA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF42DAOJVGQ4TONZYGGTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVRTG633UMVZF6Y3MNFRWW>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BPG6EC7N5ETRIZABSWNOT4L5F2ZVBAVCNFSNUABFKJSXA33TNF2G64TZHMYTKOJRGUZDSMBUHNEXG43VMU5TIOJTGQYTGOJTGUZ2C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/BPG6EC353QE7FDZP3F3BWYD5F2ZVBA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF42DAOJVGQ4TONZYGGTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVJTG633UMVZF62LPOM> and Android<https://github.com/notifications/mobile/android/BPG6EC355QHVKC7E23ICA635F2ZVBA5CNFSNUABEM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UF42DAOJVGQ4TONZYGGTHEZLBONXW5KTTOVRHGY3SNFRGKZFFMV3GK3TUVZTG633UMVZF6YLOMRZG62LE>. Download it today! You are receiving this because you are subscribed to this thread.

[anupamme]

✅ Review Feedback Addressed

I've automatically addressed 1 review comment(s):

The reviewer (dannywang0422) asked to remove the <jackson-databind.version> property definition from the <properties> section ("取消定义这个消息" = "cancel/remove the definition of this property"). Instead of defining a separate version property, the version 2.18.8 should be inlined directly in the <dependencyManagement> dependency entry. This avoids adding a one-off CVE-fix property to the global properties block while still keeping the security fix in place.

Files modified:

• jeecg-boot/pom.xml

The changes have been pushed to this PR branch. Please review!