An issue exists where the software validates the outer class of a class-name type ID but fails to properly validate classes within its generic arguments. This occurs because the `DatabindContext. resolveAndValidateGeneric()` function checks the outer class against the declared base type but passes arguments to ` validateTypeParameter()`, which validates them against the outer base type instead of their specific declared generic binding. Consequently, unrelated classes can be accepted inside a generic subtype or within plain array type IDs once the base type is approved. This can be exploited through annotation-based class-name polymorphism or configured default typing. For instance, if a property is declared as `Map<String,String>`, an attacker could provide a `HashMap<FileSystemXmlApplicationContext,String>`. If Spring is present on the classpath, this can lead to arbitrary command execution via `ProcessBuilder.start()` by loading attacker-controlled XML.