CVE-2025-70974

CRITICAL

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of t...

Affects 1 product across 2 vendors.

CVSS 3.110.0
EPSS0.8%
Percentile54th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-829: CWE-829
Related Attack Patterns (CAPEC)
CAPEC-201 Serialized Data External Linking
via CWE-829
CAPEC-228 DTD Injection
via CWE-829
CAPEC-252 PHP Local File Inclusion
via CWE-829
CAPEC-263 Force Use of Corrupted Files
via CWE-829
CAPEC-538 Open-Source Library Manipulation
via CWE-829
Show all 13

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Fastjson versions prior to 1.2.48 are vulnerable to JNDI injection due to improper handling of the @type key in JSON documents, allowing attackers to execute arbitrary code.

BSID: BS-2026-GLOBAL-277373-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-70974?
Fastjson versions prior to 1.2.48 are vulnerable to JNDI injection due to improper handling of the @type key in JSON documents, allowing attackers to execute arbitrary code.
What is the CVSS score for CVE-2025-70974?
CVE-2025-70974 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2025-70974 actively exploited?
No confirmed active exploitation of CVE-2025-70974 as of 2026-09-25.
How do I remediate CVE-2025-70974?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-70974?
CVE-2025-70974 affects Alibaba Fastjson; Class.
Vulnerability Details
CVE IDCVE-2025-70974
BSIDBS-2026-GLOBAL-277373-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2026-01-09
Last Modified2026-07-15
ICS Relevance0%
Weakness (CWE)
CWE-829
SourceNVD
Official Description

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a JSON payload with a malicious @type value pointing to a Java class with exploitable methods. When this payload is processed by Fastjson, it can lead to JNDI injection, enabling remote code execution.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Alibaba Fastjson < 1.2.48
Class — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 280 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash48c2c98daec04ca080c1ae13a2c7798a6017550cb4a1af1c69bd2d8cc66d6df1b0759fd49f7133387436f7adc8f0282eb8a530081fddca7a91b501ff62686329
Related CVEs affecting Alibaba
CVE-2021-29441 9.8 Nacos is a platform designed for dynamic service discovery and configuration ... CVE-2017-18349 9.8 parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.1... CVE-2022-25845 9.8 The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserializat... CVE-2025-15573 9.4 The affected devices do not validate the server certificate when connecting t... CVE-2026-16723 9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through...
View all Alibaba CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →