The vulnerability CVE-2026-25030 affects the Goldish product by park_of_ideas, specifically versions before 3.47. It is caused by deserialization of untrusted data, which allows an attacker to perform object injection. This can lead to remote code execution with no required privileges or user interaction. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected application and underlying system.

Patch status is not yet confirmed — no official patch or remediation information is provided in the vendor advisory or other sources. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, consider restricting network access to the affected service and applying application-level controls to limit exposure to untrusted serialized data.