CVE-2025-24779 describes a deserialization of untrusted data vulnerability in NooTheme Yogi before version 2.9.3. This vulnerability allows an attacker to perform object injection, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required. The vulnerability affects versions from an unspecified initial release up to but not including 2.9.3. No patch or official remediation details are currently provided.

Successful exploitation of this vulnerability can result in complete compromise of the affected system's confidentiality, integrity, and availability. An attacker with low privileges over the network can exploit this without user interaction, making it a significant security risk. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected application and monitoring for unusual activity related to deserialization processes. Avoid processing untrusted serialized data where possible.