{"schema":"threatline.record/2","record":{"id":"CVE-2025-70974","aliases":["GHSA-jm7w-5684-pvh8"],"summary":"FASTJSON Includes Functionality from Untrusted Control Sphere ","details":"Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","categories":["Libraries & packages"],"product":"com.alibaba:fastjson","vendor":"Alibaba","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jm7w-5684-pvh8","source_modified_at":"2026-10-05T18:38:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.alibaba:fastjson"},"range":"< 1.2.48"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-70974","source_modified_at":"2026-07-15T11:47:44.676Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Fastjson","vendor":"Alibaba","versions":[{"lessThan":"1.2.48","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8","source_modified_at":"2026-10-05T18:45:05.985873086Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.alibaba:fastjson","purl":"pkg:maven/com.alibaba/fastjson"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.48"}],"type":"ECOSYSTEM"}],"versions":["1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.20","1.1.21","1.1.22","1.1.23","1.1.24","1.1.25","1.1.26","1.1.27","1.1.28","1.1.29","1.1.30","1.1.31","1.1.31.sec01","1.1.31.sec04","1.1.31.sec06","1.1.31.sec07","1.1.31.sec10","1.1.31_noneautotype","1.1.32","1.1.33","1.1.33.android","1.1.33.sec01","1.1.33.sec04","1.1.33.sec06","1.1.33.sec10","1.1.34","1.1.34.android","1.1.34.sec01","1.1.34.sec04","1.1.34.sec06","1.1.34.sec09","1.1.34.sec10","1.1.34_noneautotype","1.1.35","1.1.36","1.1.37","1.1.38","1.1.39","1.1.40","1.1.41","1.1.41.sec01","1.1.41.sec04","1.1.41.sec06","1.1.41.sec10","1.1.42"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jm7w-5684-pvh8","source_modified_at":"2026-10-05T18:38:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.alibaba:fastjson"},"version":"1.2.48"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-70974","source_modified_at":"2026-07-15T11:47:44.676Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Fastjson","ecosystem":null},"version":"1.2.48","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8","source_modified_at":"2026-10-05T18:45:05.985873086Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.alibaba:fastjson","purl":"pkg:maven/com.alibaba/fastjson"},"version":"1.2.48"}],"cvss":10,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00756,"percentile":0.54673,"score_date":"2026-10-23"},"published_at":"2026-01-09T06:43:23.584Z","modified_at":"2026-10-05T18:45:05.985873086Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-jm7w-5684-pvh8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T18:38:46Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-70974","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-15T11:47:44.676Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T18:45:05.985873086Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-70974","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70974","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48"},{"source":"CVE List","url":"https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce"},{"source":"CVE List","url":"https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger"},{"source":"CVE List","url":"https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238"},{"source":"CVE List","url":"https://www.freebuf.com/vuls/208339.html"},{"source":"CVE List","url":"https://www.seebug.org/vuldb/ssvid-98020"},{"url":"https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2025-70974","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428203","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-jm7w-5684-pvh8","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955"},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-70974.json","tags":["x_sadp-csaf-vex"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-01-09T21:37:04.264336Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-05T18:45:05.985873086Z","content_hash":"a6c4122671bd265b5f501bfd55ab5daf196a3cbc49b7e9e06d861b5665451bb9"}}