{"id":"CVE-2026-64678","kind":"vulnerability","aliases":["CVE-2026-64678"],"related":[],"title":"Nitrite database: legacy file migration deserializes untrusted data, enabling code execution","description":"NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1.","summary":"Nitrite, a Java embedded NoSQL document store, automatically deserializes stored values with Java's ObjectInputStream when it opens an old-format database file, with no class allowlist. An attacker who can supply a crafted database file, and who has a suitable gadget class on the classpath, can run code in the host application.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-database","java","nitrite","package"],"not_affected_if":["only-trusted-database-files","version-4.4.1-or-later"],"how_to_check":"- Check the Nitrite version in the project's build file (for example `pom.xml` or `build.gradle`) or the dependency tree; a version below `4.4.1` is affected\n- Check whether the application opens database files that could come from outside the trust boundary, such as user uploads or files from other systems","fix":"- Nitrite: upgrade to `4.4.1` or later","status":"open","published_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","triaged_at":"2026-11-11T05:26:35+00:00","updated_at":"2026-11-11T05:26:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T05:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- Nitrite: upgrade to `4.4.1` or later","reach":"unknown","title":"Nitrite database: legacy file migration deserializes untrusted data, enabling code execution","impact":"high","summary":"Nitrite, a Java embedded NoSQL document store, automatically deserializes stored values with Java's ObjectInputStream when it opens an old-format database file, with no class allowlist. An attacker who can supply a crafted database file, and who has a suitable gadget class on the classpath, can run code in the host application.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","nitrite","embedded-database"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs code inside the embedding Java application","analyst_note":"Attack vector and whether a user must open a file are not stated by the sources; the description suggests the attacker supplies a database file, so reach may be local or network depending on the application.","how_to_check":"- Check the Nitrite version in the project's build file (for example `pom.xml` or `build.gradle`) or the dependency tree; a version below `4.4.1` is affected\n- Check whether the application opens database files that could come from outside the trust boundary, such as user uploads or files from other systems","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.4.1-or-later","only-trusted-database-files"],"who_is_affected":"Applications that embed Nitrite versions before 4.4.1 and open database files that may have been created or modified by an untrusted party are exposed, since the migration path runs on any file with a legacy format. Applications that only open database files they created themselves, or that use a current format, are less exposed. Exploitation also needs a gadget class on the classpath, which is common in Java applications but not guaranteed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000817,"input_tokens":4882,"output_tokens":657,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-64678':14A,17A '/readexternal':196C '/readresolve':197C '290':177C '4.4.1':95C,235C 'a.k.a':81C 'allowlist':51B,172C 'applic':77B,185C 'attack':53B 'automat':31B,103C,125C 'blocklist':173C 'byte':135C,140C 'callback':198C 'check':104C 'class':50B,67B,162C,171C,180C,205C 'classpath':70B,187C,219C 'code':10A,73B,226C 'collect':210C 'common':209C 'commons-collect':208C 'compat':119C 'craft':58B 'current':166C 'custom':146C 'cve':12A,15A 'data':8A 'databas':2A,20B,46B,59B,83C,100C 'deseri':6A,32B,130C 'detect':114C 'direct':141C 'document':29B,90C 'e.g':206C 'embed':19B,27B,89C,184C 'embedded-databas':18B 'enabl':9A 'equival':167C 'error':120C 'execut':11A,227C 'file':4A,47B,60B,101C 'format':45B,110C 'gadget':66B,204C 'hand':158C 'happen':213C 'hit':117C 'host':76B 'implement':169C 'instanti':191C 'invok':199C 'issu':229C 'java':21B,26B,36B 'java.io.objectinputstream.readobject':143C 'jep':176C 'known':160C 'legaci':3A,107C,161C 'migrat':5A,126C 'mvstoreutils.openorcreate':102C 'name':163C 'nitrit':1A,22B,24B,82C,97C 'nitritedatatype.deserialize':134C 'nitriteobjectinputstream':147C 'no2':80C 'nosql':28B,78C,88C 'object':79C 'objectinputfilt':175C 'objectinputstream':38B 'old':44B 'old-format':43B 'one':115C 'open':41B,86C,98C,122C 'overrid':151C 'packag':23B 'pass':137C 'patch':232C 'path':127C,129C 'precondit':223C 'present':216C 'prior':92C 'raw':139C 'reachabl':181C 'readclassdescriptor':153C 'readobject':193C,195C 'remap':156C 'remot':225C 'run':72B 'serializ':179C 'similar':212C 'sole':154C 'sourc':87C 'store':30B,33B,91C,111C,131C 'subclass':148C,150C 'suitabl':65B,203C 'suppli':56B 'therefor':189C 'trigger':123C 'uncondit':200C 'untrust':7A 'use':133C 'v1':109C 'v1-format':108C 'valu':34B,132C 'version':94C,234C 'via':144C,192C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Nitrite versions before 4.4.1 and open database files that may have been created or modified by an untrusted party are exposed, since the migration path runs on any file with a legacy format. Applications that only open database files they created themselves, or that use a current format, are less exposed. Exploitation also needs a gadget class on the classpath, which is common in Java applications but not guaranteed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","embeddeddatabase","java","nitrite","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-64678':14A,17A 'code':10A 'cve':12A,15A 'data':8A 'databas':2A 'deseri':6A 'enabl':9A 'execut':11A 'file':4A 'legaci':3A 'migrat':5A 'nitrit':1A 'untrust':7A","search_b":"'allowlist':51B 'applic':77B 'attack':53B 'automat':31B 'class':50B,67B 'classpath':70B 'code':73B 'craft':58B 'databas':20B,46B,59B 'deseri':32B 'document':29B 'embed':19B,27B 'embedded-databas':18B 'file':47B,60B 'format':45B 'gadget':66B 'host':76B 'java':21B,26B,36B 'nitrit':22B,24B 'nosql':28B 'objectinputstream':38B 'old':44B 'old-format':43B 'open':41B 'packag':23B 'run':72B 'store':30B,33B 'suitabl':65B 'suppli':56B 'valu':34B","search_c":"'/readexternal':196C '/readresolve':197C '290':177C '4.4.1':95C,235C 'a.k.a':81C 'allowlist':172C 'applic':185C 'automat':103C,125C 'blocklist':173C 'byte':135C,140C 'callback':198C 'check':104C 'class':162C,171C,180C,205C 'classpath':187C,219C 'code':226C 'collect':210C 'common':209C 'commons-collect':208C 'compat':119C 'current':166C 'custom':146C 'databas':83C,100C 'deseri':130C 'detect':114C 'direct':141C 'document':90C 'e.g':206C 'embed':89C,184C 'equival':167C 'error':120C 'execut':227C 'file':101C 'format':110C 'gadget':204C 'hand':158C 'happen':213C 'hit':117C 'implement':169C 'instanti':191C 'invok':199C 'issu':229C 'java.io.objectinputstream.readobject':143C 'jep':176C 'known':160C 'legaci':107C,161C 'migrat':126C 'mvstoreutils.openorcreate':102C 'name':163C 'nitrit':82C,97C 'nitritedatatype.deserialize':134C 'nitriteobjectinputstream':147C 'no2':80C 'nosql':78C,88C 'object':79C 'objectinputfilt':175C 'one':115C 'open':86C,98C,122C 'overrid':151C 'pass':137C 'patch':232C 'path':127C,129C 'precondit':223C 'present':216C 'prior':92C 'raw':139C 'reachabl':181C 'readclassdescriptor':153C 'readobject':193C,195C 'remap':156C 'remot':225C 'serializ':179C 'similar':212C 'sole':154C 'sourc':87C 'store':91C,111C,131C 'subclass':148C,150C 'suitabl':203C 'therefor':189C 'trigger':123C 'uncondit':200C 'use':133C 'v1':109C 'v1-format':108C 'valu':132C 'version':94C,234C 'via':144C,192C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T19:27:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64678","severity":null,"published_at":"2026-11-11T05:19:51+00:00","modified_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","fetched_at":"2026-11-11T05:25:40+00:00","note":null}],"documents":[{"id":122882,"url":"https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122883,"url":"https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T19:27:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}