This vulnerability affects changmingxie tcc-transaction versions 2.0 and 2.1.0 and involves a deserialization flaw in the Fastjson.parseObject function used by the Fastjson AutoType REST API component. The flaw allows remote attackers to initiate deserialization attacks, which can lead to security issues depending on the deserialized payload. The vendor has not provided any official patch or remediation guidance as of the publication date.

The vulnerability allows remote attackers to exploit unsafe deserialization in the Fastjson component, potentially leading to unauthorized code execution or other deserialization-related impacts. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low complexity, no privileges required, and no user interaction needed.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor channels for updates. In the meantime, consider disabling or restricting the use of Fastjson AutoType features or applying application-level controls to limit exposure to untrusted input.