The vulnerability is a Deserialization of Untrusted Data flaw that enables an attacker to perform an Object Injection attack. According to the official description, a malicious payload can be injected during deserialization, which may allow the attacker to execute arbitrary code or modify system state. This is categorized as CWE-502.

Affected product: Crocoblock JetEngine plugin. All releases earlier than 3.8.4.1 are impacted. The affected versions range from the earliest available release up to but not including 3.8.4.1.

The CVSS score of 8.8 classifies this flaw as High severity. The EPSS score is below 1 %, indicating that exploitation is currently not widespread. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the deserialization context; an attacker would need to supply crafted serialized data—typically via a web request or payload—to trigger the injection. Because deserialization occurs in the plugin’s processing flow, remote exploitation is plausible if the plugin is accessible over the web. The official description does not mention specific prerequisites, so the attack can be performed by any user with access to the vulnerable endpoint.