This vulnerability in Podlove Web Player (<= 5.9.1) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely over the network, requires low privileges and no user interaction, but has high attack complexity. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or fix is currently referenced in the available data.

Exploitation of this vulnerability could allow an attacker to inject malicious objects via deserialization, potentially leading to remote code execution or other severe impacts on system confidentiality, integrity, and availability. The CVSS score of 7.5 reflects a high impact. However, there are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the Podlove Web Player instances and monitor for unusual activity related to deserialization processes. Avoid processing untrusted data where possible.