# CVE-2025-70974: Alibaba Fastjson remote code execution via autoType JNDI injection

Source: https://junglewise.ai/threats/cve-2025-70974-alibaba-fastjson-remote-code-execution-via-autotype-jndi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-09. Updated: 2026-06-27  
License: CC BY 4.0 with a link back

CVE-2025-70974 · Severity: critical · CVSS 10 · Published 2026-01-09

Alibaba Fastjson, a widely used Java library for processing data, contains a critical security flaw that allows attackers to execute unauthorized commands on a server. By sending a specially crafted data file, an attacker can trick the system into connecting to a malicious external server and running harmful code. This vulnerability has been actively exploited in the wild to compromise systems, steal sensitive data, and install persistent backdoors.

Technologies: [com.alibaba:fastjson (Maven)](https://junglewise.ai/threats/technologies/com-alibaba-fastjson). Vendors: [Alibaba](https://junglewise.ai/threats/vendors/alibaba), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-70974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-70974 being exploited in the wild.

**How severe is CVE-2025-70974?** Critical severity, with a CVSS score of 10, published 9 January 2026.

**Which products and versions are affected?** Alibaba Fastjson before 1.2.48; com.alibaba:fastjson (Maven) < 1.2.48, ECOSYSTEM:introduced=0,fixed=1.2.48.

**Is there a fix for CVE-2025-70974?** Yes. com.alibaba:fastjson (Maven): upgrade to 1.2.48 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-70974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-70974?** Check whether you run Alibaba Fastjson or com.alibaba:fastjson (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.alibaba:fastjson (Maven): upgrade to 1.2.48 or later

  ```sh
  # set com.alibaba:fastjson to 1.2.48 in your pom.xml or build.gradle
  ```


## Technical details

Fastjson before 1.2.48 mishandles the 'autoType' deserialization feature. When a JSON document contains an '@type' key specifying a Java class, the library may invoke public methods of that class during parsing. An attacker can exploit this by providing a class name (such as java.lang.Class) to bypass existing whitelists and subsequently trigger a JNDI injection (e.g., via JdbcRowSetImpl) using a malicious RMI or LDAP URL. This vulnerability is an incomplete fix for CVE-2017-18349 and was later bypassed by CVE-2022-25845. It requires no authentication and can be exploited over the network, leading to full system compromise. The flaw has been observed in active exploitation by botnets like Androxgh0st.

## Affected products

- Alibaba Fastjson before 1.2.48

## Identifiers

- CVE-2025-70974
- GHSA-jm7w-5684-pvh8

## Timeline

- 2018-03-21: patched: Version 1.2.48 released to address the issue.
- 2023: exploited: Exploitation in the wild began as early as 2023.
- 2026-01-09: advisory: CVE-2025-70974 published.

## References

- [https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955](https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955)
- [https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48](https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48)
- [https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce](https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce)
- [https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger](https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger)
- [https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238](https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238)
- [https://www.freebuf.com/vuls/208339.html](https://www.freebuf.com/vuls/208339.html)
- [https://www.seebug.org/vuldb/ssvid-98020](https://www.seebug.org/vuldb/ssvid-98020)

## Related threats

- [Alibaba fastjson remote code execution in Spring Boot fat-jar deployments](https://junglewise.ai/threats/cve-2026-16723-alibaba-fastjson-remote-code-execution-in-spring-boot-fat-jar)
- [Unsafe deserialization in com.alibaba:fastjson](https://junglewise.ai/threats/cve-2022-25845-unsafe-deserialization-in-com-alibaba-fastjson)
- [Improper Input Validation in alilibaba:fastjson](https://junglewise.ai/threats/cve-2017-18349-improper-input-validation-in-alilibaba-fastjson)