Description
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Alibaba | Fastjson | 1.2.68 – ≤ 1.2.83 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 14 repositories · most starred shown
-
dinosn/fastjson-jsontype-rce-lab ★ 207 · Jul 20, 2026
Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType…
-
learner330/fastjson-cve-2026-16723 ★ 5 · Aug 5, 2026
-
why-success/fastjson-rce-lab ★ 4 · Jul 28, 2026
Fastjson 1.2.83 RCE 靶场环境 (CVE-2026-16723)
-
1xPwn/CVE-2026-16723 ★ 2 · Jul 30, 2026
A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.
-
EQSTLab/CVE-2026-16723 ★ 2 · Jul 30, 2026
Fastjson RCE
-
Ethen1212/fastjson-CVE-2026-16723 ★ 1 · Oct 23, 2026
CVE-2026-16723 Fastjson 1.2.68-1.2.83 ???? RCE ?? (java.lang.Class whitelist bypass)
-
yym8538/CVE-2026-16723 ★ 1 · Aug 21, 2026
-
Superman-L/CVE-2026-16723 ★ 1 · Aug 19, 2026
fastjson jsontype利用
-
fazilbaig1/CVE-2026-16723 ★ 1 · Jul 31, 2026
This is N-day patch we releasing by testing our model capabilities
-
HORKimhab/CVE-2026-16723 ★ 1 · Jul 25, 2026
CVE-2026-16723
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.alibaba:fastjson | >= 1.2.68, <= 1.2.83 | — | GHSA-crf3-v9rr-v7hj |