CVE-2025-70974: Alibaba Fastjson remote code execution via autoType JNDI injection

CVE-2025-70974 · Severity: critical · CVSS 10 · Published 2026-01-09

Alibaba Fastjson, a widely used Java library for processing data, contains a critical security flaw that allows attackers to execute unauthorized commands on a server. By sending a specially crafted data file, an attacker can trick the system into connecting to a malicious external server and running harmful code. This vulnerability has been actively exploited in the wild to compromise systems, steal sensitive data, and install persistent backdoors.

Technologies: com.alibaba:fastjson (Maven). Vendors: Alibaba, Maven.

Quick answers

Is CVE-2025-70974 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-70974 being exploited in the wild.
How severe is CVE-2025-70974?
Critical severity, with a CVSS score of 10, published 9 January 2026.
Which products and versions are affected?
Alibaba Fastjson before 1.2.48; com.alibaba:fastjson (Maven) < 1.2.48, ECOSYSTEM:introduced=0,fixed=1.2.48.
Is there a fix for CVE-2025-70974?
Yes. com.alibaba:fastjson (Maven): upgrade to 1.2.48 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-70974 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-70974?
Check whether you run Alibaba Fastjson or com.alibaba:fastjson (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.alibaba:fastjson (Maven): upgrade to 1.2.48 or later
    # set com.alibaba:fastjson to 1.2.48 in your pom.xml or build.gradle

Technical details

Fastjson before 1.2.48 mishandles the 'autoType' deserialization feature. When a JSON document contains an '@type' key specifying a Java class, the library may invoke public methods of that class during parsing. An attacker can exploit this by providing a class name (such as java.lang.Class) to bypass existing whitelists and subsequently trigger a JNDI injection (e.g., via JdbcRowSetImpl) using a malicious RMI or LDAP URL. This vulnerability is an incomplete fix for CVE-2017-18349 and was later bypassed by CVE-2022-25845. It requires no authentication and can be exploited over the network, leading to full system compromise. The flaw has been observed in active exploitation by botnets like Androxgh0st.

Affected products

  • Alibaba Fastjson before 1.2.48

Identifiers

  • CVE-2025-70974
  • GHSA-jm7w-5684-pvh8

Timeline

  • 2018-03-21: patched: Version 1.2.48 released to address the issue.
  • 2023: exploited: Exploitation in the wild began as early as 2023.
  • 2026-01-09: advisory: CVE-2025-70974 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.