Apache Juneau versions through 9.2.0 contain a vulnerability where parsing a value into a java.lang.Class property causes the named class to be loaded with initialization, triggering its static initializer. This improper control of dynamically-loaded code can lead to unintended code execution depending on the classes present in the deployment. The issue is fixed in version 9.2.1.