GHSA-crf3-v9rr-v7hj

fastjson has a remote code execution (RCE) vulnerability

At a glance

Published: 2026-07-23 09:32 UTC
Updated: 2026-09-10 03:51 UTC
CVE: CVE-2026-16723
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Affected packages

Package	Versions
Maven · com.alibaba:fastjson	introduced 1.2.68, last affected 1.2.83

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16723 ADVISORY
https://github.com/alibaba/fastjson2 PACKAGE
https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database