What is GHSA-4r4v-3jc5-hrg9?

GHSA-4r4v-3jc5-hrg9 is a security advisory published by GitHub Security Advisories with Low severity. A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the...

Which CVE IDs does GHSA-4r4v-3jc5-hrg9 cover?

GHSA-4r4v-3jc5-hrg9 covers the following CVE IDs: CVE-2026-9497. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4r4v-3jc5-hrg9?

GHSA-4r4v-3jc5-hrg9 has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

GHSA-4r4v-3jc5-hrg9LowCVSS 6.3

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the...

Vendor

GitHub Security Advisories

Published

May 26, 2026

Last Modified

May 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-9497 →

📋 Description

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-9497
https://github.com/Ku4D3/bug_story/blob/main/report_01.md
https://vuldb.com/submit/814092
https://vuldb.com/vuln/365480
https://vuldb.com/vuln/365480/cti
https://github.com/advisories/GHSA-4r4v-3jc5-hrg9