Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

alibaba/fastjson

              master @ c942c83
            

Fixes

CVEs

CRITICAL

Peak severity

15.0%

Coverage

Highlights

Deserialization of Untrusted Data: 29 prior fixes. Scrutinize any change in this area.

src/main/java/com/alibaba/fastjson/parser/ParserConfig.java: most-fixed (19 issues). Treat as high-risk during review.

41 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Bypasses in the autoType validation mechanism allow arbitrary class loading and execution. Attackers consistently find wrapper patterns, nested types, or array brackets to evade hash-based blocklists.

Remote Code Execution: Unsafe handling of JNDI reference injection candidates (such as javax.sql.RowSet) and arbitrary class parsing inside TypeUtils.loadClass bypasses standard constraints, resulting in immediate code execution.

Deserialization of Untrusted Data: Attackers use JVM signature characters like '[' and 'L...;' within ObjectInputStream deserialization sequences to bypass standard autoType validation checks.