fastjson-rce-lab

Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disclaimer: This lab is intended solely for security research, teaching demonstrations, and defense construction in authorized environments. Testing unauthorized targets without permission may be illegal; users bear all responsibility for the...

Exploit for CVE-2026-16723

🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType resource detect...

Alibaba Fastjson 1.2.68 < 1.2.84 RCE (CVE-2026-16723)

The version of Alibaba Fastjson installed on the remote host is 1.2.68 through 1.2.83. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stoc...

Exploit for CVE-2026-16723

Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disc...

Exploit for CVE-2026-16723

cve-id Donate Support the maintenance of this project wit...

Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE

TL;DR:A critical remote code execution vulnerability has been disclosed in FastJson, a widely used JSON processing library for Java. The vulnerability, assigned CVE-2026-16723 with a CVSS score of 9.0 Critical, affects FastJson versions 1.2.68 through 1.2.83 under specific Spring Boot deployment...

ai.foxpay.api:foxpay-sdk (>=1.0, <=1.1), ai.ylyue:yue-library-auth-client (>=j8.2.2.0, <=2.1.0) +10404 more potentially affected by CVE-2026-16723 via com.alibaba:fastjson (>=1.2.68, <=1.2.84)

com.alibaba:fastjson MAVEN version =1.2.68, =1.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =1.0.0, =1.0.6, =1.0.7 and more Source cves: CVE-2026-16723 Source advisory: MEND:CVE-2026-16723...

CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...