A flaw exists in the Fastjson.parseObject function used by the AutoType REST API of tcc-transaction. By sending a crafted JSON payload, an attacker can trigger deserialization of arbitrary objects, which may result in remote code execution or other unintended operational effects. The weakness stems from insufficient input validation (CWE‑20) and insecure deserialization practices (CWE‑502).

The vulnerability affects all releases of tcc‑transaction from changmingxie up to and including version 2.1.0. No later releases have been documented as fixing the issue, and the component is still exposed via REST API endpoints that accept JSON input.

With a CVSS score of 5.3 the flaw is rated moderate in severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. The attack vector is remote, reaching the REST API over a network connection, so an attacker does not need local access to the target system.