PT-2026-1957 · Alibaba · Fastjson

Published 2026-01-09 · Updated 2026-01-10 · CVE-2025-70974

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alibaba Fastjson versions prior to 1.2.48

Description The software contains a critical deserialization issue due to improper handling of the autoType feature, which could allow for remote code execution. The issue arises when a JSON document includes an @type key with a Java class name as its value. This can lead to calls that enable remote code execution.

Recommendations Update to version 1.2.48 or later.

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2025-70974

GHSA-JM7W-5684-PVH8

Affected Products

Fastjson

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-70974 · Security Note
• https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-70974 · Vendor Advisory
• https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48 · Note
• https://github.com/alibaba/fastjson · Note
• https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce · Note
• https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955 · Note
• https://cnvd.org.cn/flaw/show/CNVD-2019-22238 · Note
• https://twitter.com/pulsepatchio/status/2009994317461631362 · Twitter Post
• https://freebuf.com/vuls/208339.html · Note
• https://seebug.org/vuldb/ssvid-98020 · Note
• https://twitter.com/0dayPublishing/status/2009519489793020073 · Twitter Post
• https://twitter.com/CVEnew/status/2009526566695457120 · Twitter Post
• https://cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger · Note
• https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955 · Note