This vulnerability in ThemeGoods Altair arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. It affects all versions through 5.2.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the vulnerability is remotely exploitable without privileges or user interaction and can lead to full compromise of confidentiality, integrity, and availability. No official patch or vendor advisory details are available to confirm remediation status.

Successful exploitation can result in complete system compromise, including unauthorized disclosure of information, modification of data, and disruption of service. Given the critical CVSS score and the nature of object injection via deserialization, attackers could execute arbitrary code or manipulate application logic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as disabling or restricting deserialization functionality if possible or implementing input validation and filtering to mitigate exploitation risk.