https://feed.craftedsignal.io/products/nitrite--4.4.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:35 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-nitrite-deserialization-cve-2026-64678/Wed, 11 Nov 2026 13:58:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nitrite-deserialization-cve-2026-64678/The Nitrite (NO2) NoSQL database contains a vulnerability where legacy database file migration performs insecure Java deserialization, potentially allowing remote code execution if a suitable gadget class is present on the classpath.The Nitrite (NO2) database is an open source NoSQL embedded document store. In versions prior to 4.4.1, when the MVStoreUtils.openOrCreate() method detects a legacy v1-format store or encounters a compatibility error, it triggers an automatic migration path. This path deserializes stored values by passing raw bytes to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. This subclass does not implement an allowlist, blocklist, or ObjectInputFilter. Consequently, any Serializable class reachable on the application's classpath can be instantiated, leading to the unconditional invocation of readObject(), readExternal(), or readResolve() callbacks. The presence of a gadget class on the classpath is a precondition for remote code execution. This issue has been patched in version 4.4.1.

]]>criticaladvisory