Fastjson Insecure Deserialization - Remote Code Execution

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

Alibaba Fastjson 1.2.68 < 1.2.84 RCE (CVE-2026-16723)

The version of Alibaba Fastjson installed on the remote host is 1.2.68 through 1.2.83. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stoc...

Remote Code Execution

fastjson is vulnerable to remote code execution RCE. The vulnerability is due to insecure deserialization in Fastjson, where specially crafted input can trigger arbitrary code execution under the default configuration without requiring AutoType to be enabled or any classpath gadget...

The vulnerability of the AutoType mechanism in the Java Fastjson programming language library allows a perpetrator to execute arbitrary code.

The vulnerability of the AutoType mechanism in the Java Fastjson programming language library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-1672...

Deserialization of Untrusted Data

Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...

GHSA-CRF3-V9RR-V7HJ fastjson has a remote code execution (RCE) vulnerability

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

CVE-2026-16723

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

EUVD-2026-47929

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

CVE-2026-16723

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

CVE-2026-16723

CVE-2026-16723 is a remote-code-execution vulnerability in Fastjson 1.2.68–1.2.83 that is exploitable under stock/default configuration without AutoType or a gadget. Connected docs confirm the attack chain can occur in Spring Boot fat‑JAR deployments: an attacker controls the @type value, Fastjso...

VulnCheck KEV: CVE-2026-16723

A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...

AI-for-fastjson-1.2.83-RCE-skill

fastjson-1.2.83-RCEskill AI agent skill for detecting and exp...

fastjson-1.2.83-gadget-rce

fastjson-1.2.83-gadget-rce Fastjson 1.2.83 getResourceAsStre...

PT-2026-63585

Name of the Vulnerable Software and Affected Versions fastjson versions 1.2.68 through 1.2.83 Description A remote code execution RCE issue exists in the fastjson library, specifically impacting Spring Boot applications. This flaw allows an unauthenticated attacker to execute arbitrary code with...

fastjson-1.2.83-poc

Fastjson 1.2.84 ，。 Why no need for Gadgets | Hi...

Exploit for Improper Input Validation in Alibaba Fastjson

Lab 6-CVE-2017-18349 I. SYSTEM ANALYSIS Attack S...

CVE-2026-9497

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...

GHSA-4R4V-3JC5-HRG9 TCC-TRANSACTION has an Improper Input Validation vulnerability

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this...