Description
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | com.alibaba:fastjson | unspecified – < 1.2.83 | 1.2.83 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
luelueking/CVE-2022-25845-In-Spring ★ 109 · Nov 7, 2024
CVE-2022-25845(fastjson1.2.80) exploit in Spring Env!
-
ph0ebus/CVE-2022-25845-In-Spring ★ 7 · Nov 26, 2024
exploit by python
-
nerowander/CVE-2022-25845-exploit ★ 1 · Mar 1, 2023
-
cuijiung/fastjson-CVE-2022-25845 ★ 0 · Jul 11, 2025
-
scabench/fastjson-tp1fn1 ★ 0 · Jan 28, 2024
a scenario based on CVE-2022-25845 yielding a TP for metadata based SCA but a FN if the callgraph is used
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.alibaba:fastjson | >= 1.2.25, < 1.2.83 | 1.2.83 | GHSA-pv7h-hx5h-mgfj |
Advisories 1
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
References
- https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222
- https://www.ddosi.org/fastjson-poc/
- https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15
- https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d
- https://github.com/alibaba/fastjson/wiki/security_update_20220523
- https://github.com/alibaba/fastjson/releases/tag/1.2.83
- https://www.oracle.com/security-alerts/cpujul2022.html