CVE-2026-64678

Summary

Nitrite DB versions prior to 4.4.1 deserialize untrusted data from legacy database files using Java ObjectInputStream without class filtering, enabling arbitrary code execution via gadget chains when malicious serialized objects are present in the database file. This is a deserialization flaw (CWE-502) with CVSS 9.8 due to remote exploitability and full confidentiality/integrity/availability impact.

Exploitability

Exploitation requires an attacker to first inject a malicious serialized object into a Nitrite database file (e.g., via compromised data ingestion or social engineering of a local file), then trigger database opening by the vulnerable application; no network-based remote injection is possible without such prior compromise.

Blast radius

If exploited, attackers could achieve full remote code execution on the host running the vulnerable Nitrite-backed application, potentially compromising all data, systems, and services accessible to that application's process.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Nitrite version 4.4.1 or later, which implements class filtering via NitriteObjectInputStream to prevent unsafe deserialization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.