CVE-2026-9497— changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| changmingxie | tcc-transaction | 2.0 | affected |
2.1.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9497
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| changmingxie | tcc-transaction | 2.0 | cpe:2.3:a:changmingxie:tcc-transaction:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-9497
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9497
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-9497 (1)
IV. Related Vulnerabilities
Same weakness: CWE-502
- CVE-2026-45134
LangSmith Client SDK: Public prompt pull deserializes untrus - CVE-2026-47161
RELATE Vulnerable to Remote Code Execution (RCE) via Insecur - CVE-2026-44843
LangChain: Unsafe deserialization of attacker-controlled Lan - CVE-2026-24162
NVIDIA Transformers4Rec 反序列化漏洞 - CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injec
V. Comments for CVE-2026-9497
No comments yet