KCenter icon indicating copy to clipboard operation
KCenter copied to clipboard

Security fix: Resolve FastJSON deserialization vulnerability (GHSL-20…

Open artsploit opened this issue 3 months ago • 0 comments

…24-282)

  • Upgrade FastJSON from 1.2.68 to 2.0.60 for enhanced security
  • Remove dangerous ParserConfig.setAutoTypeSupport(true) calls
  • Eliminate deserialization of untrusted data vulnerability
  • Maintain backward compatibility using com.alibaba.fastjson imports
  • FastJSON 2.0.60 has autoType disabled by default, preventing RCE

Fixes security vulnerability where attackers could exploit autoType setting to instantiate arbitrary classes and potentially execute remote code through malicious JSON payloads.

artsploit avatar Nov 11 '25 10:11 artsploit