CVE-2026-64678

Name of the Vulnerable Software and Affected Versions Nitrite versions prior to 4.4.1

Description An unsafe deserialization issue exists when the database opens a file and triggers an automatic migration path for legacy v1-format stores. The process uses the MVStoreUtils.openOrCreate() function, which calls NitriteDataType.deserialize(byte[]). This function passes raw bytes to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass that lacks a class allowlist, blocklist, or ObjectInputFilter. Consequently, any Serializable class on the application's classpath can be instantiated, potentially allowing an unauthenticated remote attacker to achieve remote code execution if a suitable gadget class is present.

Recommendations Update to version 4.4.1.