CVE-2025-70974
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Vulnerability in Fastjson before version 1.2.48 allows an attacker to perform JNDI injection by manipulating the @type key in a JSON document. The attacker can invoke public methods of a specified Java class, leading to remote code execution. This flaw was actively exploited in the wild from 2023 to 2025.
Risk Assessment
The organization is at risk of remote server takeover, data leakage, or complete system compromise. The attack can be executed without authentication, increasing the risk level.
Recommendation
Immediately upgrade Fastjson to version 1.2.48 or later. Additionally, disable autoType processing and apply filtering rules for the @type key.
Original NVD description (English source)
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.