Alibaba vulnerabilities
We track 4 vulnerabilities in Alibaba products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest Alibaba vulnerabilities
- 9.0 Critical severity
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83.
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
- 10.0 Critical severity
Fastjson: Inclusion of Functionality from Untrusted Control Sphere
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there ma
- 8.4 High severity
t-head_xuantie_c910: Improper Restriction of Operations within the Bounds of a Memory Buffer
The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations, aka GhostWrite.
- 9.8 Critical severity
com.alibaba:fastjson: Deserialization of Untrusted Data
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote server