REPRO-2026-00306: fastjson2 AutoType type-resolution flaw may lead to remote code execution
REPRO-2026-00306 is verified against alibaba/fastjson2 · github vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00306.
pruva-verify REPRO-2026-00306 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00306/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Research target for the fastjson2 AutoType security issue tracked in GitHub issue #7702. The reporter states that fastjson2's AutoType parsing path is vulnerable across all released versions at the time of report (through 2.0.62) and points to PR #7695 as the relevant hardening change, while the maintainer response says the issue is confirmed and being urgently fixed, with SafeMode as the immediate mitigation.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.