Skip to content
#

jsontype

Star

Here is 1 public repository matching this topic...

dinosn / fastjson-jsontype-rce-lab

Star 191

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

security spring-boot deserialization poc rce vulnerability appsec fastjson ssrf autotype jsonsubtypes security-lab fastjson2 jsontype remote-class-loading
  • Updated Jul 27, 2026
  • Python

Improve this page

Add a description, image, and links to the jsontype topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the jsontype topic, visit your repo's landing page and select "manage topics."

Learn more