CVE-2026-112856

Summary

The vulnerability allows attackers to inject malicious serialized objects into the application via untrusted input, leading to arbitrary code execution due to unsafe deserialization in the affected Vagabonds plugin.

Exploitability

Exploitation is straightforward for remote attackers with network access, requiring only submission of a crafted serialized payload without authentication or user interaction.

Blast radius

Successful exploitation could lead to full system compromise including data exfiltration, unauthorized code execution, and service disruption on any server running the vulnerable plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Vagabonds version 1.3.11 or later, as this version contains the fix for the deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.