CVE-2026-112846

Summary

The Save Life plugin before 1.2.15 suffers from unsafe deserialization (CWE-502), allowing attackers to inject malicious objects via serialized data, potentially leading to remote code execution or other arbitrary code execution.

Exploitability

Exploitation requires sending a crafted serialized payload to an endpoint that deserializes user-controlled input without validation; no authentication or user interaction is needed.

Blast radius

Successful exploitation could lead to full system compromise including data theft, server control, and service disruption due to the CVSS 9.8 severity and network-accessible attack vector.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Save Life version 1.2.15 or later, which patches the deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.