CVE-2026-94075: Deserialization of Untrusted Data in Tribulant Software Newsletters

This vulnerability involves unsafe deserialization of untrusted data in Tribulant Software Newsletters (newsletters-lite) allowing an attacker to perform object injection. The affected versions include all releases prior to 4.18.2. The flaw enables remote attackers to execute arbitrary code or cause denial of service by sending crafted serialized data. The CVSS 3.1 score of 9.8 reflects the critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution, complete system compromise, and denial of service. The vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to full control over the affected system.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid exposing the vulnerable component to untrusted inputs or networks.