The Podlove Web Player contains a deserialization of untrusted data vulnerability (CVE-2026-24385) that allows an attacker to perform object injection. This issue affects all versions up to 5.9.1. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to inject malicious objects during deserialization, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS vector indicates that the attack can be performed remotely over the network with low privileges and no user interaction, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted data with the affected versions of Podlove Web Player. Monitor vendor channels for updates and apply patches promptly once released.