A flaw was found in the code base where usages of ObjectInputStream are without type checks. This allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.