{"action":"Upgrade com.alibaba:fastjson to 1.2.48 or later.","affected":[{"fixed":"1.2.48","introduced":"0"}],"component":"com.alibaba:fastjson","cve_ids":["CVE-2025-70974"],"ecosystem":"Maven","epss":0.00746,"exploited":false,"fixed_versions":["1.2.48"],"ghsa_id":"GHSA-jm7w-5684-pvh8","id":"tcs_01M5N937A0HB9P3WQCR3R32ZNY","modified_at":"2026-10-05T18:45:05.985873086Z","published_at":"2026-01-09T09:31:19Z","references":["https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8","https://nvd.nist.gov/vuln/detail/CVE-2025-70974","https://access.redhat.com/security/cve/CVE-2025-70974","https://bugzilla.redhat.com/show_bug.cgi?id=2428203","https://github.com/alibaba/fastjson","https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48","https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce","https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955","https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger","https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238","https://www.freebuf.com/vuls/208339.html","https://www.seebug.org/vuldb/ssvid-98020"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-jm7w-5684-pvh8","url":"https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8"}],"summary":"FASTJSON Includes Functionality from Untrusted Control Sphere"}