CVE-2022-25845

PoC —

CVSS 3.1

9.8 critical

EPSS

19%p97

Published

Jun 10, 2022 (Jun 10, 2022)

Modified

Jun 17, 2026

Description

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Vendors: alibaba oracle
Products: fastjson, communications cloud native core unified data repository
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (18.7%)

In the news2 stories

Researchers disclosed a remote code execution flaw in Fastjson Library

Security AffairsJun 16, 10:14 UTC · Jun 16, 2022Vulnerability CVE-2022-25845

High-Severity RCE Vulnerability Reported in Popular Fastjson Library

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2022Vulnerability CVE-2022-25845