Remote Code Execution in fastjson 1.2.68–1.2.83
Title source: cnaExploitation Summary
CVE-2026-16723 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including dinosn, why-success, HORKimhab.
AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.83 via unsafe @JSONType deserialization. The exploit leverages a jar: URL in the @type field to trigger class loading from an attacker-controlled server, bypassing autoType restrictions on JDK 8.
Description
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Exploits (3)
This repository provides a functional proof-of-concept for CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.2.83 via unsafe @JSONType deserialization. The exploit leverages a jar: URL in the @type field to trigger class loading from an attacker-controlled server, bypassing autoType restrictions on JDK 8.
This repository provides a vulnerable lab environment for CVE-2026-16723, a remote code execution (RCE) vulnerability in Fastjson 1.2.68-1.2.83. The exploit leverages Fastjson's checkAutoType mechanism to load a remote JAR via LaunchedURLClassLoader, bypassing SafeMode and AutoType restrictions using @JSONType annotation as a trust signal.
This repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-16723. It only includes a README with donation requests, legal disclaimers, and placeholder instructions without any functional implementation.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H