AIKIDO-2026-951730
nitrite-mvstore-adapter is vulnerable to Deserialization of Untrusted Data
98
Critical Risk
This Affects:
nitrite-mvstore-adapterTL;DR
The legacy v1 database migration path deserializes stored values from an opened file-based store through ObjectInputStream.readObject() without restricting which classes may be instantiated. When MVStoreUtils.testForMigration() processes a legacy v1-format file, ObjectDataType.deserialize instantiates any Serializable class present on the embedding application's classpath, so a crafted .db file combined with an available gadget chain achieves remote code execution before any validation runs. The patch routes v1-compat deserialization through a JEP 290 ObjectInputFilter allowlist that permits only Nitrite's own types and standard JDK types, rejecting other classes before their readObject/readResolve callbacks run.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application opens Nitrite database files that originate from untrusted sources.
Background info
nitrite-mvstore-adapter is vulnerable to Deserialization of Untrusted Data in versions 0.0.1 - 4.4.0.
How to fix this
Upgrade the org.dizitart:nitrite-mvstore-adapter library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.