Skip to content
Verified reproduction

REPRO-2026-00306: fastjson2 AutoType type-resolution flaw may lead to remote code execution

REPRO-2026-00306 is verified against alibaba/fastjson2 · github vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00306.

REPRO-2026-00306 alibaba/fastjson2 · github RCE Jul 27, 2026 .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 108m 42s
Tool calls 598
Spend $25.49
$ pruva-verify REPRO-2026-00306
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00306/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Research target for the fastjson2 AutoType security issue tracked in GitHub issue #7702. The reporter states that fastjson2's AutoType parsing path is vulnerable across all released versions at the time of report (through 2.0.62) and points to PR #7695 as the relevant hardening change, while the maintainer response says the issue is confirmed and being urgently fixed, with SafeMode as the immediate mitigation.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/logs/repro/pr7703.patch7.1 KB
bundle/repro/rca_report.md13.3 KB
bundle/repro/runtime_manifest.json1.0 KB
bundle/logs/coding/run11/proof_summary.log0.5 KB
bundle/logs/coding/run11/unit_tests.log0.7 KB
bundle/logs/coding/run11/attempt_matrix.log0.4 KB
bundle/logs/coding/run11/vulnerable_text_explicit.target.log0.3 KB
bundle/logs/coding/run11/patched_text_polymorphic.target.log1.3 KB
bundle/logs/coding/run11/patched_text_explicit.target.log1.3 KB
bundle/logs/coding/run11/patched_jsonb_explicit.target.log1.2 KB
bundle/logs/coding/run11/patched_blob_identity.txt0.3 KB
bundle/repro/validation_verdict.json0.8 KB
bundle/repro/discovery_manifest.json2.7 KB
bundle/repro/reproduction_steps.sh16.8 KB
bundle/logs/repro/run1/proof_summary.log0.4 KB
bundle/logs/repro/run1/runtime_info.json0.3 KB
bundle/logs/repro/run2/proof_summary.log0.4 KB
bundle/logs/repro/run2/runtime_info.json0.3 KB
bundle/logs/repro/run2/plain_control_response.json0.1 KB
bundle/logs/repro/run2/plain_control_marker.json0.0 KB
bundle/logs/repro/run2/safemode_response.json0.3 KB
bundle/logs/repro/version_sweep.tsv2.4 KB
bundle/logs/repro/version_sweep_summary.txt0.0 KB
bundle/logs/repro/patch_control_summary.log0.1 KB
bundle/logs/repro/patch_control_response.json0.1 KB
bundle/logs/repro/patch_control_marker.json0.0 KB
bundle/logs/repro/source_identity.log0.5 KB
bundle/logs/repro/build.log3.0 KB
bundle/logs/repro/runtime_info.json0.3 KB
bundle/logs/repro/plain_control_response.json0.1 KB
bundle/logs/repro/positive_response.json0.0 KB
bundle/logs/repro/positive_marker.json0.1 KB
bundle/logs/repro/positive_artifact.log0.0 KB
bundle/logs/repro/positive_target.log0.5 KB
bundle/logs/repro/safemode_response.json0.3 KB
bundle/logs/repro/safemode_marker.json0.0 KB
bundle/logs/repro/safemode_artifact.log0.0 KB
bundle/logs/repro/proof_summary.log0.4 KB
bundle/coding/proposed_fix.diff12.0 KB
bundle/coding/verify_fix.sh20.8 KB
bundle/coding/summary_report.md5.8 KB