A critical flaw in Nitrite, an open-source embedded database for Java, can allow code execution when an application opens a crafted database file. The vulnerability, tracked as CVE-2026-64678, carries a severity rating of 9.8 out of 10 and was published on 11 November 2026.

Nitrite, also known as NO2, is a lightweight NoSQL document store that Java applications embed to keep data in local files. The flaw sits in the library's automatic migration path for old version 1 database files. When Nitrite opens a database file, it checks whether the file uses the legacy format and, if so, migrates it, deserializing stored values with Java's ObjectInputStream without any allowlist, blocklist or filter on which classes may be created.

How the flaw can be exploited

Because no filtering is applied, an attacker who can get an application to open a malicious database file, for example through a restore-backup or import-database feature that accepts uploaded files, can have arbitrary classes on the application's classpath instantiated, with their code running automatically. The project's security advisory says this is a precondition for remote code execution if a suitable gadget class, such as one from the commons-collections library, is present, and that researchers confirmed the behaviour with a proof of concept on version 4.4.0.

The flaw is classed as deserialization of untrusted data (CWE-502) and affects all versions before 4.4.1. It is triggered automatically on every file-based store open, with no opt-out, as part of ordinary library use.

What users should do

The fix is to update Nitrite to version 4.4.1 or later. Applications that accept database files from untrusted sources should treat those files as untrusted input and upgrade before handling them.