CVE-2026-16723

This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.83 via unsafe @JSONType deserialization. The exploit leverages a jar: URL in the @type field to trigger class loading from an attacker-controlled server, bypassing autoType restrictions on JDK 8.

This exploit targets CVE-2026-16723, a deserialization vulnerability in Fastjson versions 1.2.68–1.2.83. It generates a malicious JAR payload with a reverse shell, leveraging the jar:http and jar:file protocols to trigger remote class loading and arbitrary command execution via crafted JSON input.

This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson due to improper handling of @JSONType annotations and jar: URL class loading with autoType disabled. The exploit leverages ASM to craft a malicious class with a jar-URL internal name to bypass security checks and execute arbitrary commands during class initialization.

This repository provides a functional exploit for CVE-2026-16723, a deserialization vulnerability in FastJSON (Alibaba's JSON library) that allows remote code execution (RCE) via crafted JSON input. The exploit leverages a jar:// protocol SSRF to load malicious Java classes from attacker-controlled HTTP servers or local file descriptors, achieving arbitrary command execution.

This repository provides a functional exploit for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.68-1.2.83. The exploit leverages a flaw in Fastjson's `@JSONType` annotation parsing, allowing attackers to bypass AutoType restrictions and load malicious JARs via LaunchedURLClassLoader, executing arbitrary code during class initialization.

This repository provides a Java-based scanning tool to detect the presence of vulnerable fastjson libraries (1.x and 2.x) in JAR/WAR files, including nested dependencies in Spring Boot fat-JARs. It identifies versions affected by CVE-2026-16723 and flags shaded dependencies that evade traditional dependency tree analysis.

This repository provides a functional C++ exploit for CVE-2026-16723, a deserialization vulnerability in Fastjson (versions 1.2.68–1.2.83). The exploit generates a malicious JAR with a static initializer block that executes a reverse shell via Runtime.exec(), leveraging jar:http and jar:file protocol handlers to bypass security controls.

This repository provides a vulnerable lab environment for CVE-2026-16723, a remote code execution (RCE) vulnerability in Fastjson 1.2.68-1.2.83. The exploit leverages Fastjson's checkAutoType mechanism to load a remote JAR via LaunchedURLClassLoader, bypassing SafeMode and AutoType restrictions using @JSONType annotation as a trust signal.

This repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-16723. It only includes a README with donation requests, legal disclaimers, and placeholder instructions without any functional implementation.