FASTJSON Includes Functionality from Untrusted Control Sphere
1. Executive summary Fastjson before 1.2.48 mishandles its autoType feature: when a JSON document contains an @type key whose value names a Java class,
05 Oct 2026 · 6 min read
read →