fastjson2 autoType allowlist validation flaw leading to remote code execution
The vulnerability arises because, when SupportAutoType is not enabled under the default configuration, the AutoType-disabled validation branch in fastjson2 performs prefix matching using only FNV-1a incremental hashes against default accept hashes, and does not re-verify whether the input text actually equals an allowlisted class name after a match. An attacker can construct an FNV chosen-prefix hash collision for any prefix and inject URL-form type names such as jar:/file:/http: into the @type field of the JSON request body, causing the string to be loaded and resolved by the application's context class loader and ultimately triggering arbitrary remote code execution on the server. Exploitation requires no authentication, no user interaction and no known dangerous class on the target system — only attacker control of the JSON request body.
Component
fastjson2 is a high-performance Java JSON serialization and deserialization library open-sourced by Alibaba. Its architecture uses streaming parsing a…
Refer to the PR #7695 patch, which adds acceptNameSet allowlist text re-verification in ContextAutoTypeBeforeHandler and ObjectReaderProvider and rejects type names containing ':' or '!' outright, thereby eliminating the FNV chosen-prefix hash collision bypass. As a temporary mitigation, enable SafeMode (JVM parameter -Dfastjson2.parser.safeMode=true) or switch to the noneautotype build to disable AutoType entirely, and intercept JSON request bodies containing an @type key at the WAF layer. It is also recommended to enforce a strict type allowlist on deserialization input, remove unnecessary class loading paths, and use security monitoring (RASP, DAST) for continuous detection of suspicious @type payloads.
CSSA Exclusive Early Warning
10.0 Critical
zeroclaw brute-forced due to missing rate-limit validation leading to node compromise
This flaw stems from the gateway pairing module failing to properly integrate standardized client identifier resolution, instead trusting forgeable proxy forwarding header fields as the basis for rate counting, which renders the request throttling mechanism entirely ineffective. An attacker can issue an enormous volume of blind guesses against the six-digit pairing code by supplying continuously varying source address identifiers, breaking through the preset attempt threshold and completing a brute-force attack over the public network with no interaction required. Once a valid credential is obtained, the attack chain converts it into a legitimate session token and takes over the instruction scheduling privileges of the affected node, resulting in disclosure of core system configuration and unauthorized operations.
Component
zeroclaw is an open-source automation control framework for distributed edge computing and IoT gateway scenarios. Its core architecture uses a modular…
Type
Improper Restriction of Excessive Authentication Attempts (CWE-307)
It is recommended to enforce rate counting based on the underlying transport layer address at authentication endpoints and to deploy a global sliding-window rate limiter. An exponential backoff penalty mechanism should be implemented, combined with temporary credential expiration policies and anomalous behavior detection, to fundamentally close off high-frequency brute-force paths.
CVE Intelligence
1
CVE-2026-57990
CVSS
7.4 High
2026-07-27
Microsoft Edge External File and Directory Access Vulnerability Leading to Information Disclosure
In Microsoft Edge (Chromium-based), insufficient permission control over externally accessible files or directories results in a files or directories accessible to external parties (CWE-552) security flaw. An unauthorized attacker can access these resources over the network and thereby disclose sensitive information. Microsoft Edge contains a logic flaw when handling external file access requests, which an attacker can trigger with a specific network request, leading to information disclosure. The vulnerability affects all Microsoft Edge users who have not fixed this issue. Exploitation requires some user interaction (such as luring the user to visit a specific page or perform an action), but the attack can be launched over the network without local privileges.
Component
Microsoft Edge is a cross-platform web browser developed by Microsoft, based on the Chromium engine, supporting modern web standards and a rich extension ecosystem.
Risks
Sensitive information disclosure: An attacker can obtain sensitive data from the user's local files or directories, such as configuration files, cached data or user documents
Privacy violation: Unauthorized access may expose user privacy data, which can then be used for further social engineering attacks or identity theft
User interaction required: Although user interaction is required (UI:R), an attacker can lower the exploitation barrier by luring users through phishing emails or malicious links
