The vulnerability CVE-2025-30985 affects GNUCommerce by kagla and is caused by unsafe deserialization of untrusted data, leading to object injection. This can allow remote attackers to execute arbitrary code or cause denial of service without requiring authentication. The affected versions include all releases up to 1.5.4. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to full compromise of the affected GNUCommerce system, including remote code execution, data manipulation, and service disruption. The critical CVSS score reflects the severity of potential impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted serialized data within GNUCommerce and consider applying temporary mitigations such as disabling features that deserialize external input if feasible.