Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.

More precisely, an application is vulnerable when all the following are true:

• the application is using Spring GraphQL
• the application is using Jackson 2.x for JSON deserialization
• the application exposes a paginated (Connection) field
• the application's classpath contains specific classes that can be leveraged to execute unintended logic during instantiation or deserialization

When all the conditions above are met, an attacker can craft a malicious GraphQL request that can lead to Remote Code Execution.