A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent.
XVE-2026-39684. No CVE ID assigned.S3100181015). Enable SafeMode and block the payload signatures below now.Fastjson is an open-source, Java-based, high-performance JSON parser and generator, originally developed by Alibaba and widely used for JSON serialization and deserialization across Java applications.
ThreatBook's intelligence team observed the public disclosure of a Fastjson remote code execution vulnerability. Analysis confirms that Fastjson versions ≤ 1.2.83 contain a remote code execution vulnerability: a remote attacker can execute arbitrary code on the target server by sending specially crafted malicious JSON to an application running an affected version — without relying on any third-party libraries.
Exploitation requires no user privileges. An attacker who successfully exploits it can execute arbitrary code on a target server that has not enabled SafeMode, directly threatening the confidentiality, integrity, and availability of the system and potentially leading to full compromise of the server. Affected users are advised to remediate as soon as possible.
Overall remediation priority: High risk.
| Category | Attribute | Value |
|---|---|---|
| Basic information | ThreatBook ID | XVE-2026-39684 |
| CVE ID | None | |
| Vulnerability type | RCE (remote code execution) | |
| Exploitation conditions | Network conditions for exploitation | Network-reachable |
| Requires bypassing security mechanisms | No | |
| Requirement on the target system | Fastjson SafeMode not enabled | |
| Privilege required for exploitation | No user privileges required | |
| Requires victim interaction | No | |
| Exploitation intelligence | PoC publicly available | Yes |
| Known exploitation activity | ThreatBook TDP has captured in-the-wild exploitation |
| Field | Detail |
|---|---|
| Product name | Fastjson |
| Affected versions | version ≤ 1.2.83 |
ThreatBook validated the following scenarios to date:
jar:http can be fully reproduced.jar:file method: not affected by the environments described above.
Figure 1 — Reproduction of the Fastjson remote code execution vulnerability.
No official patch or fixed version has been released for this vulnerability. Because the Fastjson 1.x series is no longer maintained, the recommended path is to migrate to Fastjson 2.x.
Until you can migrate, enable Fastjson SafeMode using any one of the following methods:
ParserConfig.getGlobalInstance().setSafeMode(true)-Dfastjson.parser.safeMode=truefastjson.parser.safeMode=trueUse protective or perimeter devices to block POST and JSON requests containing either of the following exact match strings:
@type":"jar:file:.@type":"jar:http:..The durable fix is migration to Fastjson 2.x. SafeMode and perimeter blocking reduce exposure but do not replace an upgrade off an unmaintained release line.
ThreatBook's vulnerability intelligence cataloged this vulnerability on July 20, 2026.
ThreatBook TDP added detection support on July 20, 2026. Detection ID: S3100181015. Detection is available with a model/rule version above 20260720000000. TDP has already captured this vulnerability being exploited in the wild — so environments running TDP at or above that rule version are covered against the observed exploitation activity.
Figure 2 — ThreatBook TDP detection for the Fastjson remote code execution vulnerability.
If you run Fastjson ≤ 1.2.83, enable SafeMode, block the payload signatures at your perimeter, and plan your migration to Fastjson 2.x. To see how ThreatBook TDP detects exploitation like this across your network, visit threatbook.io.