Python · MIT
dinosn/fastjson-jsontype-rce-lab
Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@JSONType(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.
★ 207
Stars
93 forks · 0 open issues
—
Growth · stale
We stopped seeing this repository in its topic's top results, so its star count is frozen at the date it was last read. Subtracting from a frozen number would read as zero growth, which would be false, so no rate is shown.
13.3
Momentum / 100
see the breakdown below
3mo ago
Created
last push 3mo ago
Star history
Only 1 snapshot so far — we started watching
this repository on 2026-10-27.
The chart appears once there are two days to compare.
How this score was built
| Component | Weight | Earned | Why |
|---|---|---|---|
| Velocity | 55 | 0.0 | — — no measurable rate |
| Acceleration | 15 | 0.0 | needs 7-day and 30-day rates side by side |
| Freshness | 15 | 6.6 | last push 3mo ago; decays to zero at 180 days |
| Scale | 15 | 6.7 | 207 stars, log-scaled against 150k — stops a 3-star repo topping the board |
| Momentum | 100 | 13.3 | capped at 35 because growth is unmeasured |
Detail
| Topics | appsecautotypedeserializationfastjsonfastjson2jsonsubtypesjsontypepocrceremote-class-loadingsecuritysecurity-labspring-bootssrfvulnerability |
| Matched on | Security (security) |
| Short window | +0 stars over 9 days = 0.0/day |
| Long window | no snapshot 14–45 days old yet |
| Lifetime average | 1.92 stars/day over 108 days |
| First seen here | 2026-10-27 |
| Last read | 11d ago |