This vulnerability permits an attacker to execute arbitrary code when fastjson parses untrusted input. It stems from uncontrolled deserialization (CWE-20 and CWE-502) that operates under the library’s stock default configuration, requiring no AutoType enablement or a classpath gadget. An attacker who can provide crafted JSON to a vulnerable application can gain full control of the system, compromising confidentiality, integrity, and potentially availability by terminating processes or disrupting services.

Alibaba’s Fastjson library, versions 1.2.68 through 1.2.83, is affected. No other vendors or product variations are listed in the CNA data.

The CVSS score of 9 highlights a high severity impact. The EPSS score of less than 1 % indicates a low probability of exploitation, yet the vulnerability’s wide exposure and lack of prerequisites means that successful attacks could cause significant damage. The vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to occur when an application deserializes untrusted JSON data using fastjson without additional safeguards.