Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-07-23T09:16:26.700Z",
  "pubdate": "2026-07-23T09:16:26.700Z",
  "executiveSummary": "A critical remote code execution vulnerability exists in the fastjson library affecting versions 1.2.68 through 1.2.83. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on target systems hosting vulnerable applications. The flaw presents a severe security risk due to its capability of being exploited under fastjson stock default configuration settings. Unlike previous iterations of similar deserialization flaws in the product, this vulnerability does not require the explicit enablement of the AutoType feature, nor does it rely on specific classpath gadgets for successful payload delivery and execution. Attackers can leverage this capability to compromise the underlying operating system, achieve complete system takeover, access sensitive data, or disrupt business-critical services. The absence of complex pre-requisites significantly lowers the barrier to entry for potential threat actors, heightening the overall severity and urgency for remediation across environments utilizing the affected fastjson versions.",
  "technicalDetails": "The vulnerability resides within the deserialization mechanism of the fastjson library, specifically impacting versions 1.2.68 through 1.2.83. The root cause stems from flaws in how the library processes and instantiates object types during JSON parsing, bypassing standard safety checks present in previous configurations. Exploitation of this vulnerability occurs remotely over the network without requiring any prior authentication or special privilege levels from the attacker. A critical aspect of this flaw is that it is exploitable under fastjson stock default configuration, meaning no manual enabling of AutoType and no reliance on specific third-party classpath gadgets are necessary for the attack to succeed.\nThe attack flow begins when an external threat actor crafts a malicious JSON payload designed to trigger unsafe instantiation or interaction with vulnerable internal components within the parser. This payload is transmitted over network protocols to an endpoint processing untrusted JSON data via the vulnerable fastjson library. Upon receiving the input, the parsing engine processes the malicious structures, leading to unsafe deserialization behavior. This behavior allows the execution of arbitrary code defined within the payload in the context of the application running the fastjson library. The post-exploitation impact includes full remote code execution, granting the attacker the ability to execute system commands, manipulate files, pivot deeper into the internal network, or deploy secondary payloads such as web shells or malware, resulting in a complete compromise of confidentiality, integrity, and availability."
}