This vulnerability (CVE-2025-60229) in Themeton Lagom involves CWE-502: Deserialization of Untrusted Data, which enables an attacker to perform object injection. The affected versions include all releases up to and including 2.0. The vulnerability is rated critical with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can lead to complete compromise of confidentiality, integrity, and availability. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation can result in full system compromise, including unauthorized disclosure of sensitive information, modification or destruction of data, and denial of service. The vulnerability allows remote attackers to inject malicious objects during deserialization, leading to arbitrary code execution or other severe impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as disabling or restricting deserialization of untrusted data if possible, and monitoring for suspicious activity related to object injection attempts.